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EXECUTIVE SUMMARY 


Telegram, an online instant messaging service popular 
among adherents of the Islamic State (IS), remains vital 
to the organization’s ecosystem of communications. The 
platform’s functional affordances, paired with relative- 
ly lax enforcement of Telegram’s terms of service (ToS), 
offers IS sympathizers a user-friendly medium to engage 


with like-minded supporters and content. 


This report examines 636 pro-IS Telegram channels and 
groups that contain English-language content collected 
between June 1, 2017 and October 24, 2018. While this 
time-bound and linguistically limited sample represents 
a sliver of the pro-IS ecosystem on Telegram, the subse- 
quent findings have important implications for policy- 
makers assigned to the dual tasks of countering IS’ online 
foothold and engaging with service providers like Tele- 


gram. Among other findings, this report assesses that: 


=" English-speaking IS supporters exploit Tele- 
gram’s suite of features to communicate with 
like-minded supporters across the world, dis- 
seminate official and unofficial IS media, and 


provide instructional material for operations. 


- Pro-IS channels and groups can be categorized 
into five primary functions: forum, shoutout, 
instructional, core and distribution. Distribu- 
tion channels are the largest category within 
the sample and serve to proliferate all types of 


pro-IS content without regard to their origin. 


- Across all channels in the sample, IS sympa- 
thizers use three primary tactics to ensure 
community resiliency: proliferating joinlinks, 
exploiting Telegram’s internal file-sharing ca- 
pabilities, and observing basic cybersecurity 


measures. 


=" English-speaking IS supporters on Telegram 
are fundamentally concerned about operational 


security, but their continued reliance on public 


outreach results in inconsistent application of 
operational security measures and exacerbates 


vulnerabilities. 


- The majority of the sample is comprised of 
private groups and channels, only accessible 
through URL keys (joinlinks), but public chan- 
nels play an important role as key nodes for en- 


try into the private network. 


- Despite Telegram’s encryption protocols and 
privacy protections, English-speaking IS sym- 
pathizers continue to rely on insecure pub- 
lic-facing platforms to reach a wider audience. 
File-sharing sites are particularly popular, rep- 
resenting 15 of the top 20 website base domains 


shared within the sample. 


The loss of IS territory and the crackdown 
against its presence on public-facing platforms 
forces English-speaking IS supporters to focus 
on the group’s military activities, ensure resil- 
ience of their networks on Telegram, supple- 
ment official media with unofficial productions, 
and develop new measures for online guidance 


of operations. 


- Within the sample, supporters discuss IS mili- 
tary activities in Iraq or Syria and the activities 
of IS’ affiliates more than IS attacks or events 


in the West. 


- No single terrorist attack outside [S-held terri- 
tory generated enough sustained conversation 
to register as one of the top 25 hashtags by name 


within the sample. 


- IS sympathizers respond to online and offline 
pressure against IS media by enabling grass- 
roots actors, proliferating unofficial or “gray” 
media, and distributing operational and in- 


structional material. 
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INTRODUCTION 


Telegram is currently considered the preferred digital communication tool for IS 
sympathizers. It serves as a stable online platform for pro-IS content, an ecosys- 
tem for building extremist networks, an effective and secure internal communica- 
tions tool, and a forum for recruiting new IS members. This report, representing 
an installation of the George Washington University Program on Extremism’s 
“ISIS Online” project, hopes to shed light on IS activity on Telegram to critically 
inform counterterrorism policymakers, practitioners and researchers, as well as 


the interested public. 
This study seeks to answer the following research questions: 


1. How do English-speaking IS supporters use Telegram’s suite of features 


to build online networks, disseminate propaganda, and guide operations? 


2. In which ways do English-speaking IS supporters on Telegram balance 
the need for broad-based messaging and recruitment with the necessity 


of operational security? 


3. How do English-speaking IS supporters on Telegram react to pressure 


against the organization in the online and offline spaces? 


To answer these questions, Program on Extremism researchers collected and an- 
alyzed 636 English-language pro-IS channels and groups on Telegram from June 
1, 2017 to October 24, 2018. This report presents the comprehensive findings and 
assessments, combining quantitative data, qualitative observations and case stud- 


ies captured during the 16-month study. 


The report begins by examining background information about Telegram’s 
unique suite of features, IS supporters’ exploitation of digital communications 
technology, and Telegram’s counterterrorism efforts. Next the report details the 
collection, coding and data cleaning process, including the PDF analysis meth- 
od and limitations of the study. In the analysis section, the report answers each 
of the three research questions using both quantitative and qualitative findings, 
supplemented by case studies of individuals who were arrested in relation to their 
pro-IS activity on Telegram. To conclude, the report offers critical considerations 
for counterterrorism policymakers, practitioners, researchers, and the media in 


marginalizing IS supporters on Telegram. 


Program on Extremism 
researchers collected 
and analyzed 636 
English-language 
pro-IS channels and 
groups on Telegram 
from June 1, 2017 to 
October 24, 2018. This 
report presents the 
comprehensive findings 
and assessments from 
the 16-month study. 
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BACKGROUND: ISLAMIC STATE SUPPORTERS’ USE OF TELEGRAM 


Prior to data analysis and investigating this study’s re- 
search questions, it is imperative to understand back- 
ground variables that inform IS supporters’ use of 
Telegram. The following section is a primer on how IS 
sympathizers use digital communications technologies. 
It documents basic information about Telegram and 
the variety of communication options available on the 
service, explains the factors behind IS’ initial adoption 
of Telegram, and compares Telegram’s functionalities 
to those of other platforms preferred by IS and its sup- 
porters. Finally, it briefly examines how Telegram has 


responded to terrorist use of the platform. 


Telegram’s Suite of Features 


Telegram is an online instant messaging service that is 
available via client applications for smartphones, tab- 
lets, and computers.' On August 14, 2013, Telegram’s 
founders Pavel and Nikolai Durov launched the first 
version of the application, which is available today on 


dozens of platforms.’ 


According to its developers, Telegram distinguishes itself 
from similar services by its speed, multimedia capabili- 
ties, and security options. Users have the ability to ac- 
cess their accounts and the information stored in it from 
multiple platforms, simultaneously.’ Telegram users 
can share an unlimited number of photos, videos, docu- 
ments, audio messages, and voice recordings in four dif- 
ferent communication options: direct one-to-one secret 
chats and voice calls, groups and supergroups that can 
include as many as 200,000 members, and channels that 


broadcast to a theoretically unlimited number of users.* 


Telegram offers end-to-end encryption features for all 
secret chats and voice calls.* For all other forms of com- 
munication, the company offers client-server/server-cli- 
ent encryption. Administrators can create public groups 
and channels that are searchable within Telegram and 
openly accessible, and private groups and channels which 
are not searchable and require a URL invite key called a 
‘joinlink” to access.° In addition to encryption and pri- 


vacy settings, Telegram offers a strict pledge to “disclose 


O bytes of user data to third parties, including govern- 
ments.” Furthermore, Telegram places their physical 
cloud servers around the world to prevent any particular 


government or authority from having sole jurisdiction.* 


IS Supporters’ Use of Telegram 


IS’ global network of supporters—whom they term mu- 
nasireen—uses Telegram as part of a larger infrastructure 
of digital communications technologies with several, in- 
terrelated functions. These technologies offer a variety of 
functions that extremist groups exploit, including “con- 
tent hosting, audience development, brand control, secure 
communication, community maintenance, financing, 
and information collection.” Laith Alkhouri and Alex 
Kassirer refer to this array of technology applications as 
the “digital toolbox.”!? IS, like other jihadist groups, ap- 
pears to select applications from the toolbox that suit par- 
ticular needs, and sometimes encourage adoption by their 
supporters. Simultaneously, the specific digital communi- 
cations technologies that IS munasireen choose to utilize 
and the services technologies offer also shape the nature 


of jihadists’ strategies for digital communication." 


IS’ major goals in utilizing the digital toolbox include facil- 
itating communications between supporters worldwide, 
disseminating propaganda, and distributing information 
and instructions from the group’s central leadership to its 
acolytes. To this end, IS and its supporters make use of a 
variety of digital communications tools, including instant 
messengers, social media, file-sharing sites, browsers, and 
mobile security services.' The use of specific technologies 
ebbs and flows as service providers attempt to limit ter- 
rorist exploitation of their applications, supporters find 


new platforms, and IS’ strategies change. 


Today, Telegram is the centerpiece of IS supporters’ on- 
line communications strategy. IS’ use of Telegram is fre- 
quently cited in the media as evidence of a new frontier 
in online jihadist communications.'? However, the cur- 
rent phenomenon and the trends behind it are not his- 
torically unique. First, IS is not the first jihadist group to 


leverage online communication tools. Beginning in the 
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Background 


1990s and moving into the 2000s, several jihadist groups 
built a stable presence on the internet, mainly through 
the establishment of top-down official websites, e-fo- 
rums, and chatrooms.'* When social media emerged as a 
facilitator for the Arab Spring, jihadist organizations ad- 
opted public-facing social media services like Facebook 
and Twitter, as well as online media-sharing platforms 
like YouTube." 


Many point to the recent trend towards terrorist 
groups exploiting privacy-maximizing services, includ- 
ing end-to-end encrypted messengers, virtual private 
networks (VPNs), secure browsers, 
and mobile security applications, 
as newfound policy concerns.’® 
However, a more thorough review 
shows that supporters of jihadist 
groups consistently strived to oc- 
clude their online activities through 
encryption protocols. For instance, 
al-Qaeda’s Global Islamic Media 
Front (GIMF) released the first 
version of its encryption software, 
Asrar al-Mujahideen (Secrets of the 
Mujahideen) in 2007, with several 
updated versions in the following 
years.” In 2013, GIMF released a follow-on program, 
Asrar al-Dardashah (Secrets of Chatting), which offered 
encryption for popular online instant messengers and 
chat forums, including Google Chat, MSN, Yahoo, and 
PalTalk.'® 


Moreover, encryption is only partially relevant in ex- 
plaining why IS munasireen choose Telegram. While end- 
to-end encrypted messaging is often cited as the major, if 
not the only reason that jihadists built an infrastructure 
on Telegram, not all jihadist communications on the ser- 
vice are covered by end-to-end encryption.” Telegram’s 
encryption protocol (MTProto) is widely criticized by 
experts in cryptography, and its security is questionable 
compared to its competitors in the instant messenger 
market.” It is not clear whether Telegram users that 
view the platform as secure believe that their privacy is 
protected by encryption, or by Telegram’s pledge to not 


share data with governments. However, commentators 


While IS supporters 
continue to be active 

on several public-facing 
sites, efforts to enforce 
terms of service (ToS) 
hampered IS’ presence 


on the public web. 


often conflate these two features or mistake Telegram’s 
privacy guarantee for “encryption.” To understand why 
IS supporters gravitate towards the platform, it is im- 
perative to take into account how Telegram fits into the 
broader digital toolbox, and how supporters exploit par- 


ticular platforms. 


Telegram emerged as the standard-bearer following 
a strategic relocation by munasireen away from main- 
stream, public-facing social media, chatrooms, and 
file-sharing services. A combination of factors, includ- 
ing enhanced enforcement of terms of service (ToS) 
on the public-facing web and the 
desire for improved operation- 
al security, caused a major shift of 
online IS supporters to Telegram 
and similar platforms. While IS 
supporters continue to be active on 
several public-facing sites, efforts 
by service providers to enforce ToS 
and the growing popularity of Tele- 
gram hampered IS’ presence on the 


public web.” 


The strategic use of Telegram and 
other encrypted messengers was ini- 
tially part of a concerted effort by IS’ external operations 
wing, which retained staffs of online facilitators directly 
responsible for such outreach.” These facilitators, re- 
ferred to as “virtual entrepreneurs” or “virtual plotters,” 
were responsible for directing 19 out of the 38 IS-related 
attacks in Western Europe from 2014 to 2016, and addi- 
tionally played a role in several plots in the United States, 
Canada, and Australia.” Starting from mainstream so- 
cial media platforms like Twitter and Facebook, virtual 
entrepreneurs would identify and contact individuals 
who were interested in planning attacks on behalf of IS, 
direct them to an instant messenger with end-to-end en- 
cryption (including Telegram), and provide instructions 


on successfully carrying out an attack.’ 


Aside from person-to-person operational communica- 
tion, IS media divisions and affiliates also exploit Tele- 
gram as a dissemination outlet. Using channels and 


groups, IS supporters publish and re-post IS’ official 
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videos, audio messages, documents and rulings, photo 
albums, and press releases on the platform.” Following 
attacks or operations, Telegram channels and groups 
are usually key nodes in the dissemination of IS’ official 
claims of responsibility, published through “official” and 
“unofficial” core news networks like Amaq News Agen- 
cy and Nashir News Agency.” The groups’ supporters 
continuously add and create new channels to remain 
abreast of new developments within IS territory, new 
media releases, and updates on critical news stories. 
They also augment these releases with unofficially pro- 


duced propaganda and media.” 


In a 2016 study, Nico Prucha describes Telegram as the 
coordination point for the “jihadist information high- 
way,” a multi-stage process for distributing IS’ official 
videos, photosets, magazines and news releases across 
the internet.” As early as 2015, IS media teams used 
Telegram channels to encourage followers to spread 
the group’s official media by 1) uploading content onto 
file-sharing sites and 2) sharing links on public-facing 
social media sites.” The same study also describes IS’ pro- 
cedure for circumventing ToS enforcement on specific 
social media platforms. On other Telegram channels, the 
group’s media operatives organize coordinated ghazawat 
(raids), in which they request followers to upload a par- 
ticular video or create new social media accounts on a 
specific platform like Twitter and Facebook.” Through 
this process, IS maintains a foothold on the public web 
and actively struggles against measures to enforce ToS, 


such as account suspensions or content removal.*! 


However, IS supporters’ reliance on Telegram also en- 
tails significant drawbacks, as its privacy features can 
make outreach and recruitment more difficult. Due to 
the necessity of accessing a joinlink to enter a private 
channel or chat group, it is much less likely that an un- 
initiated observer will “stumble” upon jihadist propagan- 
da on Telegram as compared to the public-facing web.” 
Miron Lakomy argues that the shift to closed forums like 
Telegram have slightly improved online operational se- 
curity for IS supporters at the expense of expanding on- 
line networks and the virality of IS media campaigns.” 


In the early days of IS’ Telegram usage, channels warned 


their followers about the limitations of the platform in 


this regard: 


Telegram is not a media platform for dawa 
[proselytization] to all Muslims and the West. 
No one will enter your channel except for 
the Ansar [supporters] who already know the 
truth... Rarely would you find someone from 
the general public following you. That’s why 
our main platform is where the General Public 


is found. Like on Twitter and Facebook.** 


The shift from public-facing social media platforms to 
Telegram and other reclusive services details how IS’ 
online supporters responded to pressure against the 
organization online. Namely, English-speaking IS sym- 
pathizers demonstrated agility and alacrity in moving 
between a large array of digital communications tech- 
nologies when sites like Twitter and Facebook scaled up 
their respective ToS enforcement. This history can be 
critically important in assessing how supporters on Tele- 
gram may respond if the company adopts a more strin- 


gent approach to regulating terrorist content. 


Telegram, Terrorism, and Terms of Service 


Telegram’s security features, coupled with the com- 
pany’s reticence about cooperating with governments 
and third parties on data requests in its ToS, place it 
in the public eye and on the radars of law enforcement 
throughout the world. According to Pavel Durov, one 
of Telegram’s founders, his contentious interactions 
with the Russian government when he owned the Rus- 
sian social media site vKontakte significantly influenced 
Telegram’s development.” The launch of Telegram was 
designed to provide a secure and private messaging plat- 
form to shield users in authoritarian countries from gov- 
ernment monitoring and surveillance.” However, when 
malign actors who also seek to avoid online surveillance 
exploit Telegram’s features, the company’s response of- 
ten becomes a critical test case for long-standing debates 
about online privacy, encryption, and balancing security 


with freedoms of speech and expression. 


Perhaps the greatest test facing Telegram’s stance 


on online privacy is how it chooses to respond to the 
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exploitation of the service by terrorist groups. The guar- 
antees that Telegram provides users—especially its 
promise to not provide information to governments— 
are understandably attractive to users with widely dif- 
ferent intentions, including malicious ones. An inflection 
point in the debate over the use of Telegram by terror- 
ist groups emerged after the November 2015 attacks in 
Paris, France when a cell of IS affiliates that used the ap- 
plication to communicate internally killed 130 people in 
the deadliest jihadist attack in French history.” Since the 
Paris attacks, IS inspired or directed additional attacks 
in Europe using Telegram’s group and secret chat fea- 
tures.’ Among the deadliest include the December 2016 
truck-ramming attack on a Christmas market in Berlin, 
Germany, and the mass shooting at the Reina Nightclub 
in Istanbul, Turkey weeks later.” In each case, the attack- 
ers are believed to have received direct instructions from 
IS members in Syria and Iraq regarding their planned 
attacks via Telegram’s secret chat function, alongside 


other sources.” 


Ina 2015 statement released days after the Paris attacks, 
Telegram claimed to have removed approximately 80 
ISIS public channels that were active on the platform 
at the time of the attacks.*! The company reiterated that 
despite this move, it would retain its policies of not shut- 
ting down groups, private channels, or secret chats, re- 
frain from account suspensions, and most importantly, 
continue its pledge to withhold user information from 
governments.” This policy decision shaped Telegram’s 
approach to terrorist content on its service. It created 
a dichotomy between secret chats, groups, and private 
channels—which the company views as private data not 
subject to regulation—and public channels, which the 
company argues are publicly available and therefore 
subject to limits. Since 2016, Telegram operates a chan- 
nel called “ISIS Watch” which highlights its efforts to de- 
lete public channels and bots on the service that promote 
terrorist content.* To date, the channel claims Telegram 
removed over 200,000 ISIS public channels and bots.** 
The company’s method for identifying and monitoring 
these channels is undisclosed, and presumably Telegram 
still will not suspend users, delete groups, or turn over 


profile information. 


However, a shift in the Telegram Privacy Policy signals 
that the company may be changing its tune on informa- 
tion sharing with third parties, partially in response to 
the European Union’s General Data Protection Regula- 
tion (GDPR).* In August 2018, Telegram published sec- 
tion 8.3 of its privacy policy, which claims that, “if Tele- 
gram receives a court order that confirms you're a terror 
suspect, we may disclose your IP address and phone 
number to the relevant authorities.” To date, Tele- 
gram reports that “this has never happened,” but that the 
company will include any instances of enforcement in a 


semiannual transparency report.” 


It remains unclear how this change in policy will affect 
decisions by groups like IS to utilize Telegram. In com- 
bination with the update to Telegram’s privacy policy, 
law enforcement on both sides of the Atlantic have made 
high-profile arrests of IS-inspired suspects using evi- 
dence from Telegram.“ In recent months, IS supporters 
attempted to create a presence on several other services 
which contain features similar to Telegram after an up- 
tick in channel suspensions.” So far, none of IS’ diversifi- 
cation efforts heralded the same success as the shift from 
public-facing social media to Telegram in 2015-2016.° 
For the time being, IS’ online supporter networks may 
continue to be reliant on Telegram due to the unique 
blend of features that it offers. 


In sum, conceptualizing jihadist use of digital commu- 
nications technology as a coordinated, multi-platform 
infrastructure helps correct three common mistakes in 
assessing IS’ use of Telegram. First, while neither Tele- 
gram nor IS’ embrace of the service is unparalleled, the 
combination of several important tools (one-to-one, 
one-to-many, and group communications; expanded 
file-sharing; end-to-end encryption; and guarantees of 
online privacy and security) is highly desirable. Second, 
other services offer stronger encryption and only some 
communication on Telegram is end-to-end encrypted. 
Finally, the 2015-2016 shift to Telegram in the wake 
of pressure did not represent the end of IS supporters’ 
fight to remain relevant on the public-facing web. In- 
stead, it wrought new dimensions in the fight against IS 
online as supporters leveraged Telegram to circumvent 


ToS enforcement. 


10 - The George Washington University Program on Extremism 


METHODOLOGY 


The following section provides a comprehensive account 
of this study’s methodology, with the intent of detailing 
the viability and limitations of the dataset and informing 
other researchers interested in conducting similar stud- 
ies in the future. The study’s methodology is designed to 


answer the following research questions: 


1. How do English-speaking IS supporters use Tele- 
gram’s suite of features to build online networks, 


disseminate propaganda, and guide operations? 


2. In which ways do English-speaking IS support- 
ers on Telegram balance the need for broad- 
based messaging and recruitment with the ne- 


cessity of operational security? 


3. How do English-speaking IS supporters on Tele- 
gram react to pressure against the organization 


in the online and offline spaces? 


To answer these questions, researchers used a 
mixed-method approach. Somewhat limited by Tele- 
gram’s privacy features, this method relied on manu- 
al coding, PDF analysis, and open-source research on 
case studies captured in the data set. This methodology 
section begins with a brief description of the project, 
followed by a detailed presentation of the collection, 
coding, and data cleaning approach. Next, the section 
presents the method for PDF capturing and analysis, and 


concludes by addressing the study’s limitations. 


About “ISIS Online” and the Telegram Project 


Researchers from the George Washington University 
Program on Extremism (PoE) conducted data collection 
ISIS Online” project, which 


tracks the usage of digital communications technologies 


a 


on Telegram as part of PoE’s 


by English-speaking IS sympathizers. Following PoE’s 
publication ISIS in America: From Retweets to Raqqa in 
2015, researchers collected over 1,000,000 tweets from 
English-language pro-IS Twitter accounts, analyzing the 
data in the 2017 report Digital Decay: Tracing Change over 
Time Among English-Language Islamic State Sympathizers 


on Twitter. During the data collection process for Digital 
Decay, researchers also accessed pro-IS Telegram groups 
and channels from joinlinks shared on public social me- 
dia. Starting from this initial “root” sample of channels 
and groups, PoE initiated systematic collection of pro-IS 
Telegram channels and groups with English-language 


content in June 2017. 


From June 1, 2017, to October 24, 2018, PoE researchers 
collected 727 public and private Telegram channels and 
groups. The findings of this study are based on an anal- 
ysis of 636 channels and groups which met final data 
selection standards. Notably, once a researcher joined 
a group or channel they gained access to posts dating 
back to the date of creation, backdating the sample.' Re- 
searchers were instructed to scroll back to the beginning 
of each channel to collect the channel, obtain a PDF cap- 
ture and record its data.’ At the time of collection, some 
groups and channels were active for an extensive peri- 
od of time. The earliest date of creation for a channel 
or group in the dataset is November 22, 2015, giving the 
sample a total time span of 1,067 days (152 weeks). This 
allowed researchers to collect and assess content shared 
before data collection technically began. Figure 1 shows 
the number of groups, supergroups, and channels creat- 


ed on each of the 1,067 days in the data timespan. 


Despite limitations on scope and transferability, this 
snapshot of a specific, contextualized example of IS’ ex- 
ploitation of digital communications technology pro- 
vides insight into how IS sympathizers use Telegram 
as both a communication and dissemination tool. The 
report adopts a mixed-method approach, pairing quan- 
titative and qualitative assessments of the sample with 
individual case studies to shed light on how IS sympa- 


thizers use Telegram to further their goals. 


Collection 


This report’s authors directed a research team of 
eight research assistants during the collection phase 
of the study, training each researcher in the selec- 


tion and coding criteria detailed below. Using three 
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Figure 1. This chart depicts the date of creation of the 636 groups/supergroups/channels in the sample. 


anonymous Telegram accounts with jihadist credentials 
on designated computers, project researchers employed 
a snowball sample, adding channels and groups using 
joinlinks posted in previously added entries. Utilizing 
the selection criteria, researchers determined whether 
joined channels and groups should be included in the 
sample, and assigned several variables to channels and 
groups that met the threshold. To preserve the integrity 
of the sample and preclude ethical and security concerns, 
researchers were prohibited from posting in Telegram 
groups and channels, or directly messaging any Tele- 


gram user besides the project-designated accounts. 


Selection Criteria 


To qualify for selection, the study’s parameters required 
that groups and channels were pro-IS and included 
English-language content. To meet the first criterion, 
researchers determined whether more than 50% of a 
channel’s English-language content was explicitly pro- 
IS. Indicators of pro-IS sympathies included: re-posting 
or sharing official IS media, the creation of unofficial 
pro-IS media, or overt declarations of support by chan- 
nel or group administrators for IS or its mission, goals, 
activities, and operations. Researchers avoided cod- 


ing channels or groups which supported other jihadist 


groups or expressed general sympathy for the jihadist 
movement without endorsing IS specifically, and were 
instructed to exclude channels and groups that fell close 
to the threshold. As pro-IS Telegram channel and group 
administrators are generally strict in their enforcement 
of ideological allegiance, most of the sample easily sur- 
passed the 50% threshold. 


Additionally, Telegram groups or channels in the sam- 
ple met a minimum requirement of one post in English. 
The report authors initiated this criterion to connect 
this study with PoE’s broader focus on English-speak- 
ing IS sympathizers online, but adjusted the minimum 
standard to appropriately capture the notable language 
fluidity within pro-IS Telegram channels and groups. 
For instance, PoE’s criteria for collection on a previous 
Twitter study ascribed to a minimum standard of over 
50% English-language content.’ The one post standard 
reflects an adaptation to Telegram users’ utilization of 
a variety of languages in groups, frequently with English 


as a lingua franca.‘ 


Coding Process 


When the project began in June 2017, Telegram’s reg- 


ulated API and minimal download features placed 
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limitations on data collection. To circumvent these ob- 
stacles, researchers used the print-save-as function while 
accessing Telegram from its web client to obtain Porta- 
ble Document Format (PDF) files of group and channel 
histories. As previously mentioned, when researchers 
joined channels and groups, they could access all posts 
(including shared URLs, joinlinks, documents, videos, 
and photos) dating back to the creation of the group or 
channel.° This feature allowed the database time variable 
to extend retroactively beyond the data collection period 
to November 2015. 


PDF capturing allowed researchers to record channel 
and group histories, retaining a backup copy of all posts 
in the channel or group in the event of loss of access. It 
also created a stable, accessible format for data analy- 
sis tools. However, this method also limited data col- 
lection to a snapshot of activity at the point in time of 
coding, preventing documentation of what occurred in 
the channel or group after coding. In addition, research- 
ers frequently encountered disabled channels or groups. 
The parameters of the study and Telegram’s protections 
on metadata prevented the determination of the date of 
closure, whether the closure was voluntary or the result 
of Telegram’s ToS enforcement, and whether adminis- 
trators banned or removed researchers’ accounts from 


their channel or group. 


Researchers compiled a database of all collected chan- 
nel and group PDFs. Using the PDFs, researchers add- 


ed entries to an Excel spreadsheet of quantitative and 


Observation Variables 


qualitative observations at the time of snapshot. The 
PDF database enabled retroactive analysis of shared 
content, including external links, hashtags, and joinlinks. 
In the spreadsheet, researchers recorded basic informa- 
tion about the channel or group, including quantitative 


and binary observations. (See table below.) 


Additionally, researchers coded qualitative assessments 
of entries. First, using a classification system developed 
by the report authors, researchers sorted the groups and 
channels into five categories separated by primary func- 


tion. (See table on next page.) 


Using seven binary variables, researchers also noted the 
presence or absence of discussions within channels and 
groups on six topics determined by the project team pri- 
or to data collection. These topics, modeled on previous 


studies of IS online propaganda,’ include: 


= IS military activities, battles, attacks, and 
campaigns in Syria and Iraq 

= IS non-military activities in Syria and Iraq 

= IS external provinces’ (wilayat) activities outside 
Syria and Iraq 

= IS attacks in Europe and North America 

= News and events in Europe and North America 

= Cybersecurity, information security, or 


operational security 


This sample presents a window into English-speaking IS 
sympathizer activity on Telegram using data gathered 


from collection, supplementing the information with 


Qualitative Variables 


Primary Language 


Name of Channel/Group Channel/Group Information Photos Videos 
Date and Time of Type (Channel/Group/ ae 

Channel/Group Creation Supergroup) sla gb Boguments 

Access (Public or Private) Joinlink to Access Voice Messages Members 


Date and Time of Data Entry 


Quantitative Variables 


Figure 2. These tables list the observations collected about Telegram channels and groups. 
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Categories of Groups and Channels 


Category Explanation 

Core Dedicated to content from IS propaganda brands understood to be directed by IS central media 
divisions in Iraq and Syria 

Distribution Dedicated to distributing a collection of pro-IS content, including both official and unofficial media 

Forums Groups and supergroups with multiple posters and user interaction 

Shoutout Dedicated to sharing joinlinks to other pro-IS groups or channels 

Instructional Dedicated to informative material, including cybersecurity measures or operational instructions 


Figure 3. This table defines the five categories assigned to channels and groups in the study. 


qualitative assessments and case study analysis. While 
the dataset does not represent the entirety of IS activity 
on Telegram, it reveals important insights for this specif- 


ic demographic of English-speaking IS online munasireen. 


Data Cleaning 


To ensure the veracity of the sample, researchers pe- 
riodically searched for entries with missing variables, 
joinlinks, or PDF captures. Researchers verified that all 
entries included a PDF capture of the group or chan- 
nel and a copy of the joinlink. Additionally, during data 
cleaning, the report authors checked PDF entries to en- 
sure that the channel or group in question both 1) met 
selection criteria and 2) were coded correctly. Through- 
out the course of data collection, researchers conducted 
four rounds of data cleaning, followed by a final check 
in February 2019. The conclusive data cleaning resulted 
ina final database of 636 groups and channels, including 
38,498 pages of PDF snapshots. 


PDF Analysis 


To conduct a complete analysis of the 636 PDF snapshots 
in the sample, PoE partnered with the Scholarly Technol- 
ogy Group (STG) of the George Washington University 
Libraries. STG developed URIScrape, a custom Python 
tool, using freely available Python libraries such as “pd- 
fminer” for extracting text from PDFs, “re”™ for regular 


expression pattern matching, and “urllib”"' to facilitate 


parsing of URLs. Researchers utilized URIScrape v0.2.2 
to extract URLs from the PDF to capture and refine them 
into structured data.'* With each URL discovered in the 
text, the tool collected the date and time posted in the 
corresponding group or channel. Secondly, the print- 
save-as function’s translation from Telegram’s web 
client to PDF resulted in some URL duplication, so the 
code deduplicated these using pattern-matching to a set 
number of characters beyond the URL’s domain name. 
URIScrape also matched Telegram-specific URL pat- 
terns to classify each URL into three categories: internal 
hashtags, internal joinlinks, and external URLs." Finally, 
URIScrape exported the URLs, along with each URL’s 
posting date, category, link domain, and other compo- 


nents, into an Excel spreadsheet. 


Next, researchers imported the spreadsheet into Jupyter 
Notebook, loading the data into a Pandas" data frame 
to facilitate analysis. Researchers generated various sta- 
tistical reports from the data and exported these to .csv 


files for data visualization. 


The analysis in Jupyter Notebook transformed the 17,482 
URLs classified as joinlinks into a list of nodes and edg- 
es, exported this table into .csv format, and imported the 
.csv table into Gephi for data visualization as a network 
graph. This graph represents connections among the 636 
collected Telegram groups and channels, as well as con- 


nections to groups and channels outside the sample. 
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Get the latest #IslamicState (tg://search_hashtag? 
hashtag=IslamicState) media by subscribing to the 
following public channel: 


Khilafah News 


https://telegram.me/| tg://resolve? 
domain 


#KhilafahNews (tg://search_hashtag? 
hashtag=KhilafahNews) 
#KhilafahEN (tg://search_hashtag?hashtag=KhilafahEN ) 


Khilafah News - Public | aJI ,L>/ 1 12:23:48 PM 
Amaq Agency 


Video 


| Aspects of the attack carried out by the Islamic State 
fighters in Zain neighborhood south of Damascus city. 
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Figure 4. Left: Example of a joinlink to a public Khilafah News Channel accompanied by internal hashtags. Right: Example of an Amaq 


video shared via external URLs to various file-sharing sites. Both images are taken from the PDF database which rendered all clickable links 


into full URLs causing the parenthetical duplication. 


The URL sample included 55,423 internal hashtags. 
Hashtags were grouped by week based on their posting 
dates, to determine the top hashtag per week. In addition, 
the tool extracted 46,579 external URLs (all links with 
destinations outside of Telegram) with the date of share. 
Borrowing an established methodology from Hyper- 
linked Sympathizers: URLs and the Islamic State, a study of 
URLs shared within PoE’s Twitter collection database, 
researchers used customized code to resolve and classify 
URLs by their base domain. The code also resolved acces- 
sible link-shortened URLs (such as those using bit.ly) to 


their final destination where possible.'° 


Researchers then classified the database of external 
URLs into categories based on domain type. First, re- 
searchers sorted the 20 most frequent base domains into 
website types, allowing for automatic categorization of 
77% of the URL sample. Researchers manually coded the 
remaining 23% of the 46,579 base domains into ten dif- 


ferent categories. (See table on next page.) 


Additional Comments on Limitations 


While many limitations are addressed throughout this 
section, some deserve additional consideration. The final 
database of 636 groups and channels provides insight 
into how a specific demographic of IS sympathizers use 
Telegram as both a communication and distribution 
tool. Due to its narrowed scope, the transferability of 
this sample is limited. Telegram’s metadata constraints 
prevented researchers from identifying information typ- 
ically available on open API social media platforms such 
as the location of users, when a group or channel closed, 
or if a channel or group closed voluntarily or was taken 
down. Moreover, the linguistic focus of the sample (on 
content in English) restricts the assessments made by this 
report to only a small percentage of IS activity on Tele- 


gram.'° 


The time variable is particularly restrictive as the sam- 
ple is a snapshot of 636 groups and channels collected 


at different times throughout the year. Data collection 
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Categorization of External URL Base Domains 


Category Explanation 
File-sharing: General 
File-sharing: Video 
File-sharing: Photo 

Social Media 

News and Commentary 
Government Website 
Jihadist Website 
Unresolved Link Shorteners 


Other 


Website Inaccessible 


File-sharing sites for any or multiple media, including cloud storage. 
File-sharing sites used exclusively to share videos. 

File-sharing sites used exclusively to share photos. 

Social media and social networking sites. 

News sites, blogs, and political commentary. 

Any official government website. 

Any website maintained by a jihadist group. 


URLs using link shorteners with an inaccessible final destination. 


Website could not be accessed. 


Figure 5. This table defines the categories used in defining the domains for external links shared in the groups and channels. 


revolved around the academic schedule of the project’s 
research assistants and was limited to working hours 
(0900-1700), resulting in inconsistent collection over 
time and throughout the day. Due to irregular collection, 
the sample is insufficient for assessing whether activity 
increased or decreased over the term of the collection 
period. The working hours limitation also prevented 
researchers from collecting channels and groups which 
were created and rendered inaccessible outside of that 
timeframe, especially content created in different time 
zones. Finally, the project team consistently tracked 
channels and groups on Telegram through the collection 
period, however, not all observed channels and groups 


met the threshold for the final sample. 


Researchers also recorded the number of members in 
each channel and group. At the time of snapshot, the 
sample captured a total of 100,633 members, yielding 
an average of 158 members per channel or group. While 


this is a tempting metric for analysis, membership is not 


a reliable indicator of a Telegram channel or group’s 
popularity or activity.” Within this study, member 
counts are skewed by the varied time of snapshot with- 
in the lifecycle of a channel or group. In general, the 
inability to determine who is operating a Telegram 
account prohibits membership from being an accurate 
measure of a channel or group’s reach into the pro-IS 
community. Not every member of a channel or group 
is an IS sympathizer. It is highly likely that other re- 
searchers, counterterrorism officials, curious onlook- 
ers, and trolls are captured in the membership count to 
an indeterminate degree. Furthermore, individuals can 
operate multiple Telegram accounts using fake phone 
numbers and duplicate their appearance in groups and 
channels. This report offers analyses of individual users’ 
activities on Telegram where effective data is available, 
such as in case studies or analyses of actions taken by 
channel or group administrators, but it cannot assess 
the intentions or strategies of individual members of 


channels or groups. 
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To answer the study’s research questions, the follow- 
ing section uses quantitative and qualitative analysis to 
discuss notable trends within the 636 pro-IS Telegram 
channels and groups in the sample. Subsequently, it 
evaluates three cases of English-speaking IS supporters 
whose activity on Telegram was observed within the 
sample. These case studies highlight critical dynamics in 
the IS ecosystem on Telegram, and provide context to 


the study’s results. 


While the limitations of this study preclude the findings 
from representing the entirety of IS activity on Tele- 
gram, they reveal important insights about how and why 
this specific demographic of English-speaking IS online 


munasireen utilize the platform. 


Results 
This study finds that: 


= English-speaking IS supporters exploit Tele- 
gram’s suite of features, including communi- 
cations options, joinlinks, internal file-sharing 
capabilities, and privacy protections, to com- 
municate with like-minded supporters across 
the world, disseminate official and unofficial 
IS media, and provide instructional material 


for operations. 


= English-speaking IS supporters on Telegram 
are fundamentally concerned about operational 
security, but their continued reliance on public 
outreach results in inconsistent application of 
operational security measures and exacerbates 


vulnerabilities. 


= The loss of IS territory and the crackdown 
against its presence on public-facing platforms 
forces English-speaking IS supporters to focus 
on the group’s military activities, ensure resil- 
ience of their networks on Telegram, supple- 
ment official media with unofficial productions, 
and develop new measures for online guidance 


of operations. 


1. How do English-speaking IS supporters use 
Telegram’s suite of features? 


In their use of Telegram, English-speaking IS supporters 
have access to a plethora of different tools to generate, 
package, and distribute their messaging. Whena Telegram 
user decides to initiate a multi-user message stream, they 
must first choose from a list of communications options 
which includes channels, groups and supergroups.' Figure 
6 shows a breakdown of the 636 pro-IS channels, groups 
and supergroups. Channels dominate the sample at 88%. 
This is an expected result, as channels offer several specific 
features that benefit IS sympathizers. Primarily, channels 
allow the administrators to control the flow of informa- 
tion. Only those with administrator status can post with- 
in a channel, as opposed to groups or supergroups where 
multiple members can post. Administrators of channels 
can post their own multimedia content, forward content 
from other channels and groups, and share files, joinlinks, 


or external URLs. 


Channels, Groups, and Supergroups 


40o 


Channels 
dominate the 
sample of pro-I$ 


streams on 
Telegram. 


@ CHANNELS © GROUPS @ SUPERGROUPS 


Figure 6. This chart depicts the breakdown of channels, groups, and 


supergroups in the sample. 
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Supergroups make up 10% of the sample, with regular 
groups representing less than 2%. Supergroups are likely 
preferred to groups due to the increased administrator 
capabilities and higher member limit. Whereas regular 
groups can give equal administrator privileges to each 
member, supergroups can limit privileges to specific ad- 
ministrators and provide more variety in these privileg- 
es. For example, the supergroup creator can designate 
administrators with distinct privileges to approve new 
users or block members.’ These functions enable multi- 
ple people to share some responsibilities of running a su- 
pergroup, while the creator remains in control. Another 
useful feature of supergroups is the higher member ca- 
pacity. Telegram exponentially increased the maximum 
capacity of supergroups over the years, from 5,000 in 
2015*to 10,000 in 20174, and 200,000 in 2018.° The larg- 
est supergroup in the sample, however, only contained 
3,891 members. Though the idea of the increased maxi- 
mum capacity of supergroups is likely appealing, it is not 


a feature of necessity for IS sympathizers in the sample. 


Once pro-IS users choose a communication option to cre- 
ate a multi-user message stream, they also select a main 
objective for their communication outreach. Research- 
ers categorized these goals into five primary functions of 
groups and channels: interacting with like-minded sup- 


porters (Forum), sharing joinlinks (Shoutout), sharing 


Primary Function 


Distribution 
of pro-IS material 
is the most 


5% common primary 
SHOUTOUT A 
function. 
15% 
CORE 
15% 
INSTRUCTIONAL 


Figure 7. This chart depicts the sample categorized by primary function. 


operational instructional material (Instructional), shar- 
ing “official” IS media (Core), or sharing all pro-IS media 
(Distribution). Though channels and groups can com- 
bine functionalities, researchers found that channels and 
groups tended to serve one of these five specific purposes 


in the IS ecosystem on Telegram. 


Forums, which represent 12% of the sample, provide 
space for users to interact, distribute media, and commu- 
nicate. Comprised of groups and supergroups, the forum 
function importantly allows multiple users to post their 
own messages, a disabled feature in channels. Conver- 
sations in forums are often multi-tiered, with different 
pairs of users having distinct conversations. Users can 
randomly interrupt conversations to consecutively post 
pro-IS content, trying to jettison propaganda into the 
group repository as quickly as possible. In forums, ad- 
ministrators act as minor authorities, maintaining order, 
posting rules, and threatening to remove those who dis- 
obey. Occasionally, members request administrators to 
remove specific users who they believe are trolls, spies, 
or disbelievers. These requests can be ignored or heeded 
by administrators. Forums often have a general topic or 
purpose, such as regional interests or propaganda dis- 
tribution, though the topic can easily change given the 


group dynamics. 


Shoutout channels represent a small but influential por- 
tion of the sample. Shoutout channels systematically dis- 
tribute joinlinks to other groups and channels of interest. 
Reminiscent of the use of “Baqiya family shoutouts” by 
IS sympathizers on Twitter, shoutout channels ingrain 
resiliency in the community by creating updated joinlink 
repositories. Some shoutout channel administrators ap- 
pear to use Telegram bots to automatically forward join- 
links from other channels, reducing the amount of effort 
required to maintain shoutout channels and multiplying 
the impact of a single active administrator. Additional- 
ly, shoutout channels often use general, benign channel 
names and refrain from posting IS propaganda to limit 
the possibility of discovery. Aside from the occasion- 
al channel profile image and the destination of shared 


joinlinks, shoutout channels typically remain innocuous. 
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Instructional channels distribute instructional mate- 
rial, defined as compiled, published, and disseminated 
information on how to assist terrorist groups success- 
fully and inconspicuously.” Broadly classified, the bulk 
of pro-IS, English-language instructional material on 
Telegram can be split into three categories of content: 
explosives construction, low-tech methods, and opera- 
tional and cybersecurity measures.* This study’s sample 
of Telegram channels and groups contains 94 channels 
whose main purpose is the dissemination of instruction- 
al material, representing 15% of the total. These chan- 
nels maintained an average member 
count of 113 members, and in total, 
the channels shared 7,692 photos, 
3,712 files, 1,365 videos, 1,622 links, 
293 audio files, and 25 voice mes- 
sages. Telegram’s massive internal 
file-sharing capabilities make it easy 
for administrators to disseminate 
instructional material like large PDF 
textbooks, step-by-step video tuto- 
rials, or screenshotted instructions 


with successive administrator notes. 


The final two functional categories 
are distribution and core channels. 
Core channels, representing 15% of 
the sample, are exclusively dedicat- 
ed to the dissemination of core IS 
media. Core IS media includes IS 
propaganda brands understood to be directed by IS’ cen- 
tral media department, ranging from outlets within the 
IS central media department itself (e.g. al-Hayat Media 
Center, al-Bayan Radio, al-Furqan Media Foundation) 
to outlets that take strategic direction from the central 
media division (e.g. Amaq News Agency, Nashir News 
Agency). Using the terms “official” or “unofficial” to des- 
ignate core content is limiting, as some core outlets rely 
on strategic ambiguity, portraying themselves as inde- 
pendent outlets while receiving direct orders and infor- 
mation from IS’ central media department.’ Ultimately, 
core channels serve a meaningful role in the Telegram 
ecosystem as they are assumed by supporters to be au- 
thoritative outlets of IS central media, regardless of their 


positioning vis-a-vis IS’ central media departments. 


Broadly classified, the 
bulk of pro-IS, English- 
language instructional 
material on Telegram 
can be split into three 
categories of content: 
explosives construction, 
low-tech methods, 


and operational and 


cybersecurity measures. 


Importantly, core channels self-identify as IS media 
outlets in their channel names. It is difficult if not im- 
possible to determine a specific channel’s true relation 
to an IS media outlet or leadership, as individual IS sym- 
pathizer could easily create or replicate a core channel. 
In core channels, administrators rarely share comments 
and instead post pre-packaged media updates alongside 
files using Telegram’s internal file-sharing capabilities, 
and/or links to content hosted on external file-sharing 
sites. While some core channels exclusively share con- 
tent from a single media outlet, others share an assort- 
ment content including repositories 
of Dabiq and Rumiyah, updates from 
IS wilayat, and previously-released 


propaganda films. 


Distribution channels, representing 
the majority of the sample, also share 
pro-IS media, but without regard to 
its origin. Combining elements from 
the other channel functions, distri- 
bution channels broadcast any and 
all information that could be of use, 
or interest, to the pro-IS community 
on Telegram. These channels share a 
smattering of core propaganda, pro- 
IS media from unofficial outlets, cy- 
bersecurity instructions, operational 
instructions, primary source mate- 
rials from IS ideologues, forwarded 
messages from other channels, and select joinlinks. Oc- 
casionally, administrators use distribution channels to 
share original messages, such as musings on IS, commen- 
tary on pro-IS content or cybersecurity best practices. 
The catch-all function of distribution channels contrib- 
utes to its prominence in the sample. Many distribution 
channels could be further categorized to determine a 
main content topic; however, the overall function of dis- 
tribution channels is to broadcast an array of content for 


the IS sympathizer. 


Across the five categories of channels and groups in 
the sample, IS sympathizers employ three key tactics 
to increase the resiliency of the pro-IS community on 


Telegram. IS sympathizers adopt certain features and 
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practices, creating a unique ecosystem with its own be- 


haviors and norms. 


The first observed tactic is the proliferation of join- 
links. While there are entire channels dedicated to the 
distribution of joinlinks, other channels and groups also 
post joinlinks to keep members abreast of the latest up- 
dates within the community. Administrators or users 
will share joinlinks to consecutive channels or groups, 
sometimes instructing users to join a page without con- 
tent and wait for it to become active, to join at a specific 
time, or to join only after the previous iteration is re- 
moved. Additionally, administrators can post time-sen- 
sitive joinlinks that deactivate at the whim of the ad- 
ministrator, sometimes in a matter of hours or minutes. 
Using Telegram’s administrator toolkit, administrators 
can manually change the joinlink or set an automatic ex- 


piration time to render the joinlink inaccessible.'® 


Supplementing this qualitative observation with quanti- 
tative data, URIScrape captured 17,482 joinlinks shared 
by channels and groups in the sample. Using Jupyter 
Notebook and Gephi, researchers ascertained the source 
and target of each joinlink, as well as how many times 
each source channel or group shared a link to a specif- 
ic target channel or group. Using a dummy variable for 


each target whose Telegram unique identifier did not 


2:35:50 AM 
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join us my brother on Khilafah al islamiyah 
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Figure 8 Example of a time-sensitive joinlink to a private group chat. 


Joinlink Network 


40.57% 
(7,093) 

This node represents 
all joinlinks to channels 


and groups external 
to the sample. 


59.43% 
(10,389) 

Joinlinks shared 
between channels and 
groups in the sample. 


Figure 9. This is a visualization of all 17482 joinlinks within the sam- 
ple, created in Gephi. The majority of joinlinks are between channels 
and groups within the sample, although a substantial percentage direct 


users towards external Telegram channels and groups. 


appear in the sample, the research team categorized 
each joinlink as “internal” (between a source and target 
that are both within the sample) or “external” (between a 
source in the sample and a target outside of the sample). 
Figure 9 is a network diagram of all joinlinks captured in 
the sample. Interestingly, most joinlinks were internal: 
10,389 joinlinks (59%) were internal, while the remain- 
ing 7,093 joinlinks (41%) were directed towards external 


channels and groups." 


This network analysis is affected by the snowball sam- 
ple method utilized for this report. Joinlinks shared in 
channels and groups represented the main way of find- 
ing new channels and groups. However, the result also 
coincides with known strategies of IS supporters on 
Telegram and other platforms. To protect against ad- 
versaries and shield new public groups and channels 
from ToS enforcement, administrators prepare multiple 
variations of channels and groups, instructing members 
to join them all and wait for them to become active.'” 
This is similar in function to a strategy used on Twit- 
ter, where suspended IS sympathizers quickly created 


new accounts and used the “Baqiya family” network of 
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Telegram’s protected, 
multi-purpose and effective 


file-sharing capabilities are 
particularly attractive for 
IS sympathizers. 
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Figure 10. This graph depicts the breakdown of files shared internally within the 636 groups and channels. 


“shout-outs” to inform the community of their new ac- 
count information." These operational resiliency tactics 
transferred to Telegram, and also partially explain the 


interconnectedness of the sample. 


The second observed key tactic is the use of internal 
file-sharing to distribute a variety of content. At the 
time of snapshot, users in the sample internally shared 
a total of 63,401 photos, 22,966 documents, 10,406 vid- 
eos, 4,030 audio files, and 970 voice messages across the 
636 channels and groups. These files range in content, 
from core IS propaganda to grassroots generated pro- 
IS memes, from speeches by jihadist ideologues to press 
releases from IS’ adversaries, and from bomb making in- 


structions to VPN tutorials. 


Telegram’s internal file-sharing capabilities and its tac- 
tical employment by IS sympathizers is significant for 
three primary reasons. First, Telegram’s file-sharing size 
allotment is unparalleled compared to other popular 
social media and messaging services. Telegram allows 
users the ability to share large files of up to 1.5GB, ap- 
proximately one full-length standard definition film." 
Contrarily, WhatsApp only allows users to share 16MB 
videos equaling about 90 seconds.'* Second, Telegram al- 


lows users to share multimedia files beyond just photos 


and videos to include audio files, voice messages, and 
all document types such as PDFs and Word documents. 
Twitter, on the other hand, only allows users to share 
small videos, photos or GIFs.'° Third, files shared on 
Telegram benefit from the same protections as chats 
and posts, meaning they remain accessible unless the 
entire group or channel is closed or taken down (in the 
case of public channels). Users in the sample appear to 
take advantage of this feature and the security afforded 
by internal file-sharing. Combined together, Telegram’s 
protected, multi-purpose and effective file-sharing ca- 
pabilities are particularly attractive for IS sympathizers 
hoping to collect and distribute pro-IS content. This un- 
paralleled suite of file-sharing features allows Telegram 
to operate as a “clearinghouse” for IS material, acting as 


itinerant, but persistent, cloud storage for members." 


The third observed tactic concerns the adoption of 
general cybersecurity practices when accessing and 
communicating on Telegram. Across the sample, users 
employ basic cybersecurity measures to obscure any 
potentially identifying information. Using Telegram’s 
file-sharing features, IS sympathizers frequently dis- 
tribute instructions on how to use VPNs, create fake 
Telegram accounts and phone numbers, and adopt pri- 


vacy software. Channel and group administrators urge 
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members to employ these tactics to protect themselves 
from IS’ enemies. Whereas on Twitter, some pro-IS users 
would tweet pictures of themselves or openly share their 
location,'* IS sympathizers on Telegram safeguard this 
information. Within the sample, IS sympathizers tend to 
use generic profile images, post minimal information on 
their profiles, and refer to each other only by username 
or pseudonym (kunya). Users are observant of these cy- 
bersecurity tactics and weary of anyone who does not 


follow suit, occasionally calling them out as spies. 


7:00:57 AM 


= ` N S297. 
BismAllah 


In this channel we will provide a detailed explanation of computer 
protection and hidden in the net 


And since most computer users are using the Windows system will 
be an explanation of this system. 


But we must first note that Microsoft is a spy company that 
collaborates with the US National Security Agency and violates the 
privacy of users, follows their steps on the computer and gathers all 
their data. Therefore, alansar should use alternatives systems to 
Microsoft products as we are looking for a complete Hidden in the 
net because the US National Security Agency and the crusader 
alliance considers us a treasure of valuable information that helps 
them target the Mujahideen and spy on them so you are responsible 
for your electronic security and responsible for the security of your 
brother Mujahid 


solsort 


Figure 11. This post served as the introduction to a channel dedicated 


to cybersecurity tactics, followed by detailed instructions on how to use 


non-Microsoft operating systems. 


Notably, Telegram already has inherent cybersecurity 
measures in place to protect user data. Telegram does 
not take down individual accounts, or require anything 
more than a phone number to sign up. Even then, IS 
sympathizers on Telegram encourage each other to use 
fake phone numbers, adding another degree of separa- 
tion. Researchers observed periodic comments from 
pro-IS users who noted that Telegram is generally un- 
safe and filled with spies, journalists and other adversar- 
ies, giving necessity to protective measures. Regardless 
of the debatable necessity of cybersecurity and resiliency 
measures, one could argue that these measures are now 
inherent within the larger IS online ecosystem." With 


plenty of time to learn tactics and methods on public 


facing media, these practices transferred onto Telegram 


and will continue to evolve. 


2. In which ways do English-speaking IS supporters 
on Telegram balance the need for broad-based 
messaging and recruitment with the necessity of 
operational security? 


In utilizing digital communications technologies like 
Telegram, IS supporters must use tools to distribute mes- 
saging and propaganda, communicate internally, contact 
potential recruits, and inject the group’s narrative into 
wide-reaching public debates. Simultaneously, they must 
also protect these messages and conceal their operations 
from the watchful eyes of adversaries, na mely counterter- 
rorism authorities and other IS opponents. As highlighted 
in the background section, these two objectives are gener- 
ally at odds with one another, and require IS’ supporters 
to strike a delicate balance. Understanding this dilemma 
between mass messaging and operational security can 
help reveal key vulnerabilities in IS’ use of Telegram and 


other digital communications technologies. 


A simple metric for examining how English-speaking 
IS supporters on Telegram navigate this dynamic is 
through the privacy feature. Unsurprisingly, the major- 
ity of the sample (70%) is comprised of private groups 
and channels, only accessible through joinlinks. Tele- 
gram’s private setting is the simplest form of its securi- 
ty offerings, protecting content through client-server/ 
server-client encryption. Private groups and channels 
are inaccessible from search functions and insulated 
from the general conversation on Telegram. However, 
using private groups and channels alone would close off 
pro-IS content to a predetermined number of recruits, 
preventing the possibility of a potential recruit accessing 
channels and groups. As a result, a substantial minority 
(30%) of all groups and channels in the sample are public. 
They can be accessed through searches within Telegram, 


and do not require a joinlink. 


In a breakdown that disaggregates channels, groups, 
and supergroups by their privacy settings, as shown in 


Figure 12, private channels represent a decisive majority 


22 - The George Washington University Program on Extremism 


Clifford & Powell 


Privacy Settings 


The majority 
of the sample 


comprises private 
groups and 
channels. 


Figure 12. This chart depicts the privacy settings of the 636 groups, 


supergroups, and channels in the sample. 
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Figure 13. This chart depicts the breakdown of the privacy setting and 
message type of each of the 636 entries in the sample. 


at 59% of the sample. The combination of privacy and 
channel features explained above illustrate the assessed 
motivations for using this message stream. Public chan- 
nels are the second most popular messaging stream, 
representing 29% of the sample. These public channels 
are accessible through search functions, though still 
relegated to Telegram and separate from other public 
search engines. Public channels are also accessible from 
URLs, which can be shared and copied freely, with the 
only barrier to entry being a prompt to login. These pub- 
lic channels often served as key nodes in the network 
and systematically shared joinlinks to access private 


groups and channels. 


Collection captured only three public supergroups and 
groups, comprising a negligible percentage of the sample. 
While public supergroups and groups are still insulated 
from the general internet and provide ample administra- 
tor privileges, they appear to be an unpopular tool with 
the sample. This is likely due to the perceived operational 
security vulnerability. Supergroups and groups are de- 
signed to facilitate conversation and interaction, which 
IS supporters would logically prefer to do within a pri- 


vate environment. 


Interestingly, Telegram treats private channels, private 
groups, and public groups equally when it comes to en- 
forcing its ToS. Telegram’s policy states that “all Tele- 
gram chats and group chats are private amongst their 
participants,” and its current approach precludes take- 
downs of private channels. In addition, Telegram does 
not process any requests related to groups, even those 
concerning illegal content.” Therefore, under Telegram’s 
current approach to ToS enforcement, only public chan- 
nels, which represent 29% of the collected sample, would 


be eligible for takedowns. 


Telegram’s reluctance to take down private content 
helps demonstrate why English-speaking IS supporters 
are attracted to the platform, and provides context to 
their fundamental desire for operational security. On 
public-facing social media, where this demographic’s 
content, accounts, and networks are removed at an in- 
creasingly quick rate and can also be shared with third 


parties, supporters expect limited freedom of movement 


Encrypted Extremism - 23 


Analysis 


and potential repercussions for sharing terrorist content. 
The breakdown of public and private content within the 
sample shows that English-speaking IS supporters are, 
at the very least, concerned about operational security 


and make some attempts to conceal their activities. 


At the same time, however, this demographic of IS sup- 
porters also lead frequent engagements to ensure that 
their narrative reaches a wider audience. Two pertinent 
examples are external file-sharing and distributing URL 
links to major social media platforms. These are major 
aspects of IS’ online strategy of ghazawat, wherein sup- 
porters coordinate outreach and attempt to retain access 
to public-facing social media in the face of ToS enforce- 
ment. These efforts demonstrate that English-speaking 
IS supporters desire to communicate with a wider audi- 


ence, despite their relative seclusion on Telegram. 


While using Telegram’s file-sharing features to dissem- 
inate content internally, IS sympathizers on Telegram 
use external file-sharing sites to ensure IS content re- 
mains on the internet and resilient to takedowns. Using 
channels and groups, they distribute dozens of unique 
URLs to a single piece of pro-IS material on different 
file-sharing sites external to Telegram. This ensures 
that if content is removed from one site, stable access 
exists to others. The resultant URLs can then be copied 
onto Twitter, Facebook, and other mainstream social 


media platforms. 


To examine English-speaking IS supporters’ external 
engagements, researchers analyzed 46,579 URLs lead- 
ing to destinations outside of Telegram. URIscrape re- 
solved URLs to their base domain and categorized them 
by website type. In total, the sample includes 731 unique 
base domains. The top 20 base domains by frequency are 
displayed in Figure 15. These results show a clear prefer- 
ence for file-sharing sites, which represent 15 of the top 
20 most frequent base domains within the sample and 
55% of the total URL count. 


Using Telegram as a node for distribution, this demo- 
graphic of IS supporters attempts to exploit a wide range 
of different file-sharing sites. Within the 46,579 URLs 
in the sample, IS supporters generated 27,161 links to 


130 unique file-sharing platforms. Figure 16 shows a 
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Figure 14. Example of an Al Hayat video shared via numerous URLs 


to external file-sharing sites for streaming and downloading. 


breakdown of URLs by base domain type, wherein a 
majority of URLs shared in the sample were towards 
file-sharing platforms. These data demonstrate a key 
link in the chain of distribution of media releases from 
Telegram to public-facing platforms. When online mu- 
nasireen distribute a major media release, such as a new 


video, photo series, or claim of responsibility for an 
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Figure 15. This chart shows the top 20 base domains of external URLs by order of frequency in the sample. 


attack, they immediately share external links on Tele- 
gram to a variety of file-sharing sites.’ Using their ar- 
senal of generated URLs, they re-post content from the 
file-sharing sites to public-facing social media platforms 
ad infinitum.” In this fashion, if one platform removes 
the content, it remains accessible on several others. Ad- 
ditionally, some of the file-sharing sites that were most 
frequently used may not have the resources, expertise, or 
interest to adequately monitor and moderate terrorist 


content. 


Three of the four most frequently used general file-shar- 
ing domains (archive.org, justpaste.it and top4top.net) 
are pertinent examples. Despite their small size, these 
three platforms account for 42% of all file-sharing links 
and 22% of all external URLs in the study. Archive.org 
is the home of the Internet Archive, which includes a 


non-profit, multimedia file hosting platform and the 


Wayback Machine, which allows users to access archived 
versions of websites saved over time.” Justpaste.it is a 
free-to-use, non-profit hosting platform initially man- 
aged by a Polish graduate student, that supports video, 
photo, and text content.” Top4top.net is another small 
content hosting site that is popular in the Middle East.” 
Unlike their larger competitors, smaller platforms face 
additional barriers to removing pro-IS content on their 
platforms, and stringent enforcement of ToS may not be 


feasible given the resources at their disposal.” 


Besides file-sharing, the category of base domains that 
was most frequently linked to was social media plat- 
forms, showing IS supporters’ continued insistence in 
exploiting mainstream social media. Twitter, the former 
nexus of English-speaking IS online activity, remains a 
popular destination for external links from Telegram. 


Sampled channels and groups shared 3,933 unique URLs 
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Domains by Category 


A majority of 
URLs shared in the 
sample were toward 
file-sharing 
platforms. 
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Figure 16. This graph categorizes base-level domains based on web- 
site type and shows the share of each category in the total external 
URL count. 


with a Twitter base domain. The second most-linked 
social media platform was the Russian social network 
service Odnoklassniki, although this platform also allows 
content hosting. Interestingly, despite its popularity in 
the West, the sampled channels and groups only shared 
146 links to Facebook base domains, making it the 37th- 


ranked base domain overall. 


The ubiquity of external file-sharing and efforts to engage 
on major social media demonstrates that despite moving 
to Telegram, English-speaking IS supporters continue to 
rely on public-facing platforms to disseminate their mes- 
sage to a wider audience. Despite what initially appears 
to bea predominant concern with operational security, a 
closer look reveals that this reliance on reaching a wider 
audience can, at times, override or even conflict with the 
necessity to implement operational security protocols. 
For instance, a substantial percentage of supporters in 
the sample created public channels, even though they are 
indexed on Telegram, subject to takedown, not end-to- 
end encrypted, and observable to an unknown number 
of adversaries. In external file-sharing and posting on 
social media, supporters potentially release informa- 


tion that could provide a link between their Telegram 


account and their presence elsewhere online, such as an 
IP address. These interplays clearly demonstrate the dif- 
ficulty that many English-speaking IS supporters face in 
using Telegram for both mass messaging and operation- 
al security functions, and the opportunity for counterter- 


rorism authorities to exploit vulnerabilities. 


3. How do English-speaking Islamic State 
supporters on Telegram react to pressure against 
the organization in the online and offiine spaces? 


During the period of data collection for this study, IS 
faced overwhelming pressure in both its physical ter- 
ritory and the online realm. The sample coincides with 
IS’ key military defeats, including the conclusions of 
months-long sieges of the towns of Raqqa and Mosul, 
which displaced IS from major bases of operations in 
Syria and Iraq. Meanwhile, major social media pro- 
viders and technology companies engaged in extensive 
campaigns to remove pro-IS users and content from 


their platforms. 


This study’s findings suggest two notable responses by 
English-speaking IS supporters in the wake of online and 
offline pressure. First, in times of duress for IS, this de- 
mographic of supporters more frequently engages with 
content that highlights the group’s military activities, as 
well as the efforts of its worldwide affiliates. Sympathiz- 
ers discuss these topics more often than news, events, or 
IS-claimed attacks in the West, or IS’ non-military activ- 
ities (governance, infrastructure, economy, etc.). Second, 
evidence suggests a decentralization of IS media com- 
mand and control due to ongoing pressure, resulting in 
three growing strategic themes in English-speaking IS 
supporters’ activities on Telegram: the rise of grassroots 
actors, the proliferation of “gray” media, and the distri- 


bution of operational and instructional material. 


Two queries of this study’s data establish the content 
shift towards military activities. First, researchers con- 
ducted basic analysis of IS’ supporters’ reactions to cur- 
rent events using a binary variable to note the presence 
or absence of six popular topics. Of these topics, the 
most frequent were discussions about IS’ military activ- 


ities in Syria or Iraq, which took place in approximately 
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60% of channels and groups within the sample, and the 
activities of IS’ affiliates, which occurred in 44%. Be- 
tween the most frequent topics and the four remain- 
ing topics, there is a significant drop in frequency. For 
instance, 16% discussed news and events in Europe or 
North America, 13% discussed cybersecurity or infor- 
mation security, and 11% discussed IS’ non-military 
activities in Syria or Iraq. Notably, from these six vari- 
ables, the least-frequent topic concerned IS attacks in 
Europe or North America, which was discussed in less 


than 11% of all channels and groups. 


Secondly, using URIScrape, researchers isolated 55,423 
hashtags posted within the Telegram channels and 
groups in the sample. While hashtags are not as ubiq- 
uitous on Telegram as on other social media platforms, 
they are consistently used by IS sympathizers, partic- 
ularly when trying to disseminate news and rally the 
conversation around specific topics. The top 25 hashtags 
used throughout the sample are included in Figure 17. In 
general, the main hashtags used by this demographic of 
supporters during this timeframe include the names of 


key news agencies and media releases (#AmaqAgency, 


Top 25 Hashtags 


#KhilafahNews, #Rumiyah), locations of battles in- 
volving IS and its affiliates (#Mosul, #Raqqa, #Homs, 
#DeirEzzor, #Marawi), and markers for IS’ adversaries 
(#PKK, #Rafidi,” #Iraqi). 


Notably, supporting other analyses of IS hashtag cam- 
paigns on social media, no hashtags in the top 25 directly 
reference [S-inspired terrorist attacks in the West, de- 
spite the sample’s focus on English-language channels 
and groups. During the period of collection, IS was in- 
volved in critical military campaigns in Iraq, Syria, and 
elsewhere. In July 2017, as data collection formally be- 
gan, the siege of Mosul concluded; months later, IS was 
forced out of its de facto capital city in Raqqa.” Other key 
battles, such as IS-affiliated forces’ takeover and subse- 
quent defense of the town of Marawi in the Philippines 
(May-October 2017) also register as top hashtags.” The 
use of hashtags generally correlates with IS official media 
releases, which during this period generally focused on 
the group’s military campaigns, battles, and defenses of 
its strongholds. They serve as markers for content that 


can later be re-posted on other social media platforms, 
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Using URIScrape, researchers 
isolated 55,423 hashtags posted 


within the Telegram channels and 
groups in the sample. 
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Figure 17. This figure shows the top 25 hashtags within the sample by frequency. 
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especially on Twitter, while packaging IS media products 


for other audiences.*” 


While no single terrorist attack outside [S-held territory 
generated enough sustained conversation to register as a 
most-used hashtag by name, one hashtag, 4J UST_TER- 
ROR, is a harbinger for IS supporters’ campaigns to pro- 
mote claims of responsibility for major attacks and incite 
further violence outside of Syria and Iraq.*! #JUST_ 
TERROR is one of the top 25 most-used hashtags, but to 
further understand when and why it was used, a time-se- 
ries analysis is necessary. Figure 18 is a chart showing the 
five weeks in which #)UST_TERROR was the most-used 
hashtag during 68 weeks of data collection for the sam- 
ple, alongside the event that resulted in the proliferation 


of the hashtag during that week. 


Weeks with #JUST_TERROR as Top Hashtag 


The five weeks in which 4] UST_TERROR was the most- 
used hashtag contain significant media campaigns by IS 
supporters to take credit for major attacks outside IS- 
held territory. However, only two of these weeks coincid- 
ed with attacks in the West. During the week of July 14, 
2017, IS supporters promoted a shooting on the Temple 
Mount in Jerusalem using the #4) UST_TERROR hashtag.” 
Throughout the week of August 25th, 2017, IS Telegram 
channels and groups pushed claims of responsibility, 
calls for further attacks, and unofficial media products 
following two truck-ramming attacks in Barcelona and 
Cambrils, Spain on August 17, 2018.** Three weeks later, 
munasireen launched another campaign using the hashtag 
after a botched bombing by an IS supporter at the Par- 


sons Green Underground station in London.*4 Two other 


Week Event 


IS Claim 


July 14, 2017 


August 25, 2017 


September 15, 2017 


December 1, 2017 


March 30, 2018 


Three gunmen shoot at Israel Border Police officers near 
the Temple Mount in Jerusalem, killing two police officers. 
The resulting firefight kills all three attackers. 


Several members of a terrorist cell conduct vehicular and 
bladed weapon attacks in Barcelona and Cambrils, killing 
16. Police killed four of the five perpetrators at the site of 
the second attack, and the fifth after a manhunt. 


An improvised explosive device detonates on a train at 
Parsons Green Underground station in London, causing no 
deaths and over 30 injuries. The perpetrator is arrested a 
day later. 


On November 24, 2017, 40 gunmen stormed the al-Rawda 
mosque in Egypt’s North Sinai Governorate, killing over 
300 people. 


An attacker in Southern France hijacks a car and opens 
fire on police officers before driving to a supermarket, 
shooting several civilians, and taking hostages. Police 
storm the supermarket and kill the attacker. Including the 
attacker, five are killed and 15 wounded. 


IS claims responsibility through Amaq 
News Agency. 


IS claims responsibility through Amaq 
News Agency. 


IS claims responsibility through Amaq 
News Agency. 


No group formally claims responsibili- 
ty; reporting assesses IS Sinai Province 
to be responsible for the attack. 


IS claims responsibility through Amaq 
News Agency. 


Figure 18. Weeks with #]UST_TERROR as the top hashtag and the coinciding event. 


28 - The George Washington University Program on Extremism 


Clifford & Powell 


attacks— the November 2017 attack on a Sufi mosque in 
al-Rawda, Egypt,” and a shooting that led to a standoff 
with hostages in Trébes in March 2018*°—also resulted 
in #JUST_TERROR becoming the most-used hashtag 
during the week of the attack. 


Overall, however, #JUST_TERROR and other hashtag 
campaigns to refer to IS attacks in the West do not gen- 
erally sustain frequency beyond one week, and metrics 
relating to this sample demonstrate a sustained en- 
gagement with IS’ military campaigns in Syria and Iraq 
through Amaq News Agency updates and geograph- 
ic hashtag markers relating to Syrian and Iraqi cities. 
These findings parallel other studies on IS online media 
from both the supply-side and demand-side perspective. 
Daniel Milton and Charlie Winter independently found 
that as IS lost territory in Syria and Iraq, it released more 
content pertaining to military activity and cut back on 
depictions of governance, commerce, and religious af- 
fairs.” Examining a similar demographic to this study, 
Audrey Alexander also found that terrorist attacks in the 
West failed to sustain discussion among English-speak- 
ing IS supporters on Twitter, despite the makeup of the 
demographic.** In combination with the results of this 
study, these findings suggest that IS’ military activities 
in Syria and Iraq area much stronger determinant of the 
content of discussions by English-speaking IS supporters 
on Telegram than other topics, especially events in West- 


ern Europe and North America. 


While English-speaking IS supporters have always fluc- 
tuated between strict adherence to IS central media’s 
guidelines and agendas and determining their own 
course, the weakening of IS’ centralized institutions due 
to military and digital pressure arguably prompted a 
decentralization in command and control over its me- 
dia. Leaving aside debates about the quantity or quali- 
ty of IS’ official media productions, IS’ English-speak- 
ing supporters are increasingly emboldened to become 
producers of media rather than consumers in response 
to pressure on the group. Within the study, researchers 
observed three notable themes in how this demographic 


responds to online and offline pressure against IS media. 


First, individual users take action to ensure the resilien- 
cy of online networks and exert authority. They build 
personalities behind usernames, avatars, and kunyas, 
establish media brands, connect with users around the 
world, distribute pro-IS propaganda, share cybersecurity 
best practices, and attempt to recruit and mobilize new 
members using Telegram. By creating name and brand 
recognition, individual supporters on Telegram become 
sought-after commodities and take up the mantle of 
promoting the IS cause in the digital space. With the de- 
cline of IS official institutions in Syria and Iraq and the 
evolution of internal disputes within the group, these in- 
dividuals are empowered to take an active role in leading 


networks and producing pro-IS material online. 


Second, “gray media” outlets with vague IS connections 
produce extremist content that is in line with IS’ ideo- 
logical goals and occasionally in direct support of IS. 
These outlets include media groups with questionable 
affiliations to IS, as well as grassroots media labels os- 
tensibly run by individuals.” Both create propaganda 
stylized in the IS image but branded as third-party con- 
tent. Enabled by Telegram’s internal file-sharing capa- 
bilities and external links to file-sharing sites, Telegram 
hosts a spectrum of unofficial content which is difficult 
to precisely categorize. The spectrum of “gray media” in- 
cludes singular images marked by rudimentary editing, 
translations of official core content, and products by 
branded media groups.” This content often replicates or 
modifies core content, superimposing different imagery 


or adding commentary. 


Finally, operational and instructional materials distrib- 
uted through Telegram contain pertinent examples of 
how online, grassroots IS supporters respond to a lack 
of official guidance. To account for the dearth of avail- 
able, officially-produced English instructional materi- 
al, administrators of pro-IS channels and groups often 
re-appropriate English-language instructional material 
from non-IS sources, create it themselves, or both. Ad- 
ministrators of pro-IS Telegram channels and groups 
dedicated to the dissemination of core media, propa- 
ganda, and ideological products often enforce guidelines 
that ensure that all posters maintain strict allegiance 


to IS.“ In the operational/instructional space, however, 
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administrators seem to assume that their audiences are 
generally less discerning in the distinctions between var- 
ious strands of jihadist material. This is reflected in the 
diversity of media posted within pro-IS Telegram chan- 


nels dedicated to instructional material. 


Aspects of these themes were present within IS media 


before the uptick in pressure against the organization 


on the public-facing web and IS’ territorial downfall. 
But recent online and offline developments intensified 
the relevancy of these trends in studying the activities 
of IS’ sympathizers in the virtual realm. Namely, as IS 
transitions from a territory-holding organization, it will 
be critically important to understand how online muna- 
sireen react to the collapse of the Caliphate and new stra- 


tegic directions from IS leadership. 
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While quantitative and qualitative data are vital as- 
pects of studying IS content on Telegram, individual 
case studies provide concrete examples of how En- 
glish-speaking IS sympathizers utilize the platform for 
a variety of functions. During the data collection peri- 
od, three individuals were arrested in relation to their 
pro-IS efforts on Telegram whose activity was also 
observed in the sample: Karen Aizha Hamidon, Ashraf 
Al Safoo, and Husnain Rashid. Pairing open-source re- 
search on these cases with original data from Telegram 
provides a unique window to what goes on behind the 


screen of an English-speaking IS supporter. 


Notably, each case embodies one of the three key 
themes observed during data collection on Telegram: 
the rise of grassroots actors (Hamidon), the prolifera- 
tion of gray IS media (Al Safoo), and the distribution 
of operational and instructional material on Telegram 
(Rashid). The three profiled IS supporters used differ- 
ent tactics pursuant to their specific goals and aims, 
shedding light on the variety of ways Telegram can be 
used in the IS online ecosystem. Overall, the cases serve 
as examples of how IS’ English-speaking munasireen 
exploit Telegram’s suite of features, balance outreach 
and operational security, and react to ongoing pressure 


against the organization. 


Karen Aizha Hamidon: Grassroots Actors in 
the English-Speaking IS Online Ecosystem 
On October 11, 2017, authorities in the Phil- 


ippines arrested Karen Aizha Hamidon on 14 
counts of inciting to rebellion or insurrection for 
her online activity in support of IS.’ Hamidon, a 
36-year old resident of Taguig City, Philippines, 
reportedly recruited individuals to join and fight 
with IS affiliates.” Hamidon is the widow of Mo- 
hammad Jaafar Maguid, the leader of the IS-af- 
filiated jihadist group Ansar Al-Khilafah Philip- 


pines and a suspect in the 2016 Davao bombing.’ 


Though Hamidon’s case received scant coverage in 
Western news sources, her actions on Telegram are em- 
blematic of the many ways IS sympathizers can leverage 
digital communications to become semi-authoritative 
figures in the pro-IS online ecosystem. By building her 
own persona on Telegram, Hamidon mobilized indi- 
viduals in several countries, including the United States, 
India, the Philippines, and Singapore, and inserted her- 
self within a transnational network of IS supporters. She 
became known by name as a facilitator and directed new 
members to her network. An analysis of connected court 
cases in India and the U.S. shed light on her online oper- 
ations, as well as key vulnerabilities in English-speaking 


pro-IS networks on Telegram. 


India’s National Investigation Agency (NIA) found that 
Hamidon worked as an IS online network facilitator, di- 
recting and welcoming new members to pro-IS groups 
on several platforms.‘ In one pertinent example from 
February 2015, Hamidon added an Indian man named 
Mohamed Naser to her “Islam Q&A” WhatsApp group 


where, “subsequently, the accused started doing graphic 


designing work on the instructions of Karen [Hamidon].” 
By April 2015, Hamidon added Naser to three of her pro- 


IS groups on Telegram, where he attained information 
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Figure 19. Karen Hamidon upon arrest in the Philippines. (Source: Newsweek) 
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on traveling to Syria to join IS.* During Naser’s failed 
attempt to travel to IS-controlled territory via Sudan in 
2016, he was arrested with a piece of paper containing 
the phone numbers for members of Hamidon’s “Islam 
Q&A” WhatsApp group, indicating the perceived oper- 


ational viability of this network.® 


The subsequent NIA investigation into Naser and Hami- 
don’s online presence led to the indictment of 17 mem- 
bers of a cell of IS operatives trying to establish a Ca- 
liphate in India under the name Jund al-Khilafa al-Hind.’ 
The cell was directed by Shafi Armar (Yusuf al-Hindi), 
an Indian national who joined IS in Syria and reported- 
ly died on the battlefield in March 2019.° In Hamidon’s 
extended Indian network, she served as an integral facil- 
itator, using Telegram to propagate IS ideology, recruit 
others into IS, and facilitate and raise funds for the travel 
of recruits to Syria.” NIA documents claim that network 
members “in connivance with Karen... were involved in 
propagating ideology of the ISIS by sharing and circulat- 
ing text messages, images, videos and making telephonic 
calls to Indian youths inciting them for recruitment of 
the ISIS.”"° 


Though Hamidon’s contacts primarily resided in South 
and Southeast Asia, some evidence suggests that her on- 
line network extended into the United States.'! On De- 
cember 30, 2017, the Federal Bureau of Investigation ar- 
rested Virginia resident Sean Duncan after he destroyed 
evidence during an authorized search of his residence 
pursuant to an international terrorism investigation. 
According to court documents, FBI agents interviewed 
Hamidon on July 25, 2017, while she was in the custo- 
dy of a foreign government. In the interview, Hamidon 
claimed that Duncan was “one of” her U.S. based con- 
tacts.” Hamidon and Duncan first made contact on so- 
cial media in January 2015, then moved to “encrypted 
mobile messaging applications.”!? Together, they talked 
about support for IS, traveling to join IS, attacks, home- 
made bombs, and the prospect of marriage. Their contact 
dwindled after Hamidon rejected Duncan’s proposal of 


marriage and hijrah to join IS in Syria in March 2015." 


Interestingly, this is not the only time Hamidon toyed 


with the idea of marriage to a new contact. Hamidon 


reportedly had unofficial, online marriage agreements 
with at least three pro-IS contacts.'* Hamidon’s use of 
marriage as a recruitment tactic likely contributed to 
the confusion around her relationship with Singaporean 
Muhammad Shamin Mohamed Sidek, who was arrested 
in August 2015 on IS-related charges in Singapore.'® Re- 
ports claimed the two were married, but the Singapore 


Ministry of Home Affairs dispelled this inaccuracy.” 


However, Hamidon’s assumed online authority, net- 
working style, and personal idiosyncrasies created ten- 
sions. A document from the NIA investigation recounts 
a dispute between Hamidon and another member of her 
network, Mohammed Sirajuddin, on Telegram, appar- 
ently over Hamidon’s willful disclosure of users’ person- 
al telephone numbers.'* This is the first spark of dissent 
against Hamidon’s haphazard approach towards opera- 
tional security. To rally opposition Sirajuddin started a 
Telegram group dedicated to spreading negative infor- 
mation on Hamidon. In this group, Sirajuddin speculat- 
ed that Hamidon was involved in the disappearance of 
Abu Hatim “Mad Mullah,” a prominent online facilitator 
of foreign fighter travel believed to be operating from 
Sudan. In retaliation, Hamidon removed Sirajuddin 


from her Telegram groups.” 


This tactic is frequently observed in groups within this 
study’s sample, as members attempt to remove “spies.” 
During data collection, researchers observed several 
Telegram-based campaigns against Hamidon, which 
peaked in intensity before her arrest in the Philippines in 
October 2017. In several Telegram groups, users shared 
Hamidon’s usernames, profiles, Telegram IDs, and 
phone numbers with warnings against contacting Hami- 
don. Users also asked other members to delete Hamidon’s 
contact information and asked group administrators to 
remove her. Posts against Hamidon were frequently for- 
warded from groups with names like “Exposing Karen’s 
Lies” or “Karen Watch.” Longer posts accuse Hamidon of 
involvement in the arrests of Mohammed Sirajuddin and 
Musa Cerantonio, a prominent Australian IS supporter, 
and allege that she is a government spy. Users lambasted 
Hamidon for her braggadocio, shameless demands for 


money from men, and penchant for confrontation, and 
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Figure 20. Messages captured in the sample posting against Karen. 


claimed that if she was telling the truth about her con- 


nections to IS, she would have already been arrested. 


Through forwarded messages from other users, the 
Telegram data also captures Hamidon’s attempts to de- 
fend herself. Hamidon sent private messages to users, 
defending her allegiances and claiming a network of 
connections to IS affiliates in the Philippines. Hamidon 
claimed she had run-ins with the Filipino justice system 
but avoided sentencing through luck and good lawyers. 
When her outreach failed, Hamidon infiltrated groups 
by creating fake online identities with similar usernames 
to her accusers to “ruin their reputations.” Some users 
appeared to take her side and asked group administra- 
tors to remove those “slandering” Hamidon. These users, 


however, appeared to be in the minority of the sample. 


Shortly before her arrest, users speculated Hamidon’s 
whereabouts and shared images of identification cards 
including her Postal Identity Card and Tupperware 
Brand Saleswoman ID card. When Hamidon was arrest- 
ed on October 7, 2017, those who accused her of being a 


spy celebrated the arrest as a victory for the Islamic State. 


Hamidon’s case exemplifies the English-speaking pro-IS 
ecosystem’s reliance both on mutual trust and individ- 
ual diligence. During data collection, researchers often 
observed users accusing each other of being spies. These 
frequently appeared as one-off instances where the “spy” 
would be removed, or the administrators would ignore 
the accusations. Telegram’s security measures prevent 


users from knowing who controlled accounts behind the 


screen.” While users directed campaigns against “spy” 
accounts, removed “spies” could create new accounts or 
change their username, update their profile information 
and continue using Telegram. These observations sup- 
port existing research which notes trending suspicion, 
hesitancy, and cybersecurity practices within IS activ- 
ity online.” Hamidon, however, inspired a movement 
across channels and groups, intent on removing her and 
all her accounts from the entire ecosystem. Users drew 
direct lines between her numerous Telegram accounts 
and her real-world identity, freely sharing her personally 


identifiable information. 


The case of Karen Hamidon provides an invaluable win- 
dow into the ecology of English speaking IS sympathiz- 
ers on Telegram. Hamidon’s extended network spans 
over 25+ countries, demonstrating how the decentral- 
ized structure of IS sympathizers on Telegram allows 
individuals to quickly become part of a larger, online 
movement. Though Hamidon’s exact role remains un- 
confirmed, her actions illustrate the value of network 
facilitators online. While based in the Philippines, Hami- 
don was able to create international networks, insert her- 
self in conversations, and wage campaigns against users. 
Her actions potentially included facilitating the travel of 
IS supporters to Syria and the Philippines, raising funds 
to facilitate travel, directing propaganda creation, and 
convening users in support of IS primarily using Tele- 
gram. Additionally, she demonstrated a command of 
Telegram and used its security features to her advantage 
when challenged: creating fake profiles to endorse her 


side of the story, making copies of her enemies’ profiles 
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to sabotage their reputations, and removing users with 


whom she disagreed from her groups and channels. 


Hamidon’s case also supports the idea that the functions 
of digital communications technologies, like anonymity 
and profile duplication, can reduce obstacles to wom- 
en’s activism in terrorist groups which traditionally do 
not support female leadership.” Though Hamidon faced 
scrutiny for disobeying gender norms within the IS com- 
munity on Telegram, she exploited Telegram’s suite of 


features to remain an authoritative figure. 


To date, Hamidon’s exact role as both a source to au- 
thorities and an IS supporter is unclear. On one hand, 
she is a common thread between numerous success- 
ful arrests. Her tactics, such as demanding money and 
keeping contact lists, could indicate a desire to gath- 
er information for authorities. On the other hand, she 
deliberately connected IS supporters. Her cooperation 
with authorities and willingness to provide information 
may have been an act of self-preservation. In both situa- 
tions, her case presents an example of the potential value 
and opportunity of sowing discord in pro-IS communi- 
ties on Telegram. The inability to prove who operates a 
Telegram account, while frequently a disadvantage for 
investigations, could be a positive feature for counter-IS 
operations. The delicate balance of trust and suspicion 
that characterizes the pro-IS ecology on Telegram is ripe 
for exploitation. The international reach of online net- 
works, coupled with Telegram’s provision of backdated 
data when a user joins a group or channel, provides an 
opportunity to multiply successful leads. Counterterror- 
ism authorities can take note of these issues highlighted 


in Hamidon’s case for future operations. 


Ashraf Al Safoo and Khattab Media Foundation: 
Gray Media 


On October 17, 2018, the FBI arrested Ashraf Al Safoo, 
a 34-year-old resident of Chicago, Illinois. Al Safoo is 
charged with one count of conspiracy to provide material 
support and resources to IS for his actions as part of the 
Khattab Media Foundation (KMF).”* Allegedly, Al Safoo 
“aided ISIS in using social media to spread propaganda 


supporting violent jihad, to recruit operatives, and to 


encourage others to carry out terrorist attacks.”** An FBI 
undercover employee spearheaded the investigation by 
posing as an aspiring KMF contributor, communicating 
with Al Safoo directly, and infiltrating the private KMF 
Staff and Writers groups on Telegram. Court documents 
from the Al Safoo case detail the complex, virtual orga- 
nization behind KMF. Within the data collected for this 
study, KMF was a notable gray media outlet, producing 
content that was actively redistributed by English-speak- 


ing IS supporters across Telegram. 


KMF produced a variety of propaganda products, in- 
cluding “edited video content, articles, essays, and info- 
graphics.” The videos mentioned in the criminal com- 
plaint give insight into how KMF combined elements 
from official IS propaganda, open-source media, and 
original content. For instance, on October 19, 2017, 
KMF released a video titled, “The Brothers in Marawi.””° 
The video used footage of IS fighters in the Philippines 


and an English-language nasheed which was released five 


Khattab Media Foundation 


Figure 21. Top: Ashraf Al Safoo (Source: Chicago Sun-Times); 
Bottom: Khattab Media Foundation logo. 
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days earlier by al-Hayat Media Center.” Additionally, 
in December 2017, KMF released a video titled, “Our 
Gifts Are Ready,” which uses a combination of origi- 
nal low-quality animation, mainstream news footage, 
and IS videos to communicate a Christmastime threat 


against multiple Western states.” 


The criminal complaint also details KMF’s organization- 
al structure, which consisted of Al Safoo and at least 17 
unnamed co-conspirators. On Telegram, KMF operated 
within two private groups—the “Staff Group” with join- 
link access and 21 members, and the “Writer’s Group,” 
a private group with 13 members.” The Writers Group 
functioned as a forum for KMF’s leaders, wherein deci- 
sions could be discussed before communication to the 
more general Staff Group. Structurally, KMF is divided 
into six divisions: writing, design, production, audio, up- 
load and publishing, each with its own division head. Al 
Safoo was allegedly promoted to the head of the writers’ 
division in March 2018.” Before publication on Telegram 
and other sites, KMF content passed through the appro- 
priate division, moving through a standard approval pro- 
cess. After the final product was approved, a translation 
department translated content from Arabic into several 
languages, including English, French, Bengali, and Italian, 


often by using online translator applications.*! 


When products were ready for publication, KMF strived 
to improve their online outreach. Like other IS propagan- 
dists, KMF attempted raids on social media, primarily 
Twitter, to inject their products into the public sphere.” 
KMF members were aware of social media companies’ 
efforts to remove extremist content from their plat- 
forms, and thus took steps to circumvent these policies.” 
To maintain a presence on Twitter, KMF members cre- 
ated numerous fake accounts, shared account logins, and 
hacked the accounts of legitimate social media users. Us- 
ing TOR and VPN software when operating on public 
platforms, they employed operational security measures 
to hide their identities.**To execute Twitter raids, mem- 
bers arranged publications, set times for release, gath- 
ered accounts, implemented cybersecurity measures, and 
prepared hashtags. Specific channels were dedicated to 
sharing the prepackaged raid information, streamlining 


distribution.” 


Two KMF tactics highlight how IS sympathizers adapt 
to ToS enforcement on public-facing social media sites. 
First, IS sympathizers hack legitimate social media ac- 
counts to avoid account suspensions, presenting another 
challenge for social media companies seeking to de-plat- 
form IS sympathizers. One KMF member directly ac- 
knowledged this fact, claiming that a hacked account “is 
better because it stays with you longer,” and, “you are bet- 
ter off spending an hour hacking than a minute in create 
an account.” In general, KMF members seemed keenly 
aware of takedown policies and were intent on staying 
one step ahead. This assessment supports established con- 
cerns with reactive takedown policies and the need for 


proactive marginalization of extremist actors online.” 


The second tactic of note is the integration of cyberse- 
curity measures within KMF’s operations. The FBI as- 
sessed that Al Safoo practiced “sophisticated” cyberse- 
curity measures, by using TOR, VPNs, a pre-paid cash 
phone, different email addresses, and multiple Telegram 
accounts.” Al Safoo’s cybersecurity skills likely stemmed 
from his 10-year career in IT and master’s degree in 
computer science.” Despite his unique professional ex- 
perience, Al Safoo is not the only IS sympathizer with an 
interest in cybersecurity techniques. Across Telegram, 
researchers observed a prevalence of cybersecurity in- 
formation concerning VPNs, TOR, creating multiple 
accounts, and basic skills. The integration and prolifer- 
ation of cybersecurity practices by IS-sympathizers on 
Telegram is a reality that law enforcement, policymak- 
ers, and social media companies must consider when 


trying to combat terrorist content online. 


The day-to-day operations of KMF also reveal a great 
deal about the positionality of ostensibly “unofficial” 
pro-IS media outlets vis-a-vis the group’s central appa- 
ratus. Three incidents detailed in the criminal complaint 
illustrate KMF’s connection to the IS central media de- 
partment. On November 30, 2017, a member posted a 
set of rules in the Staff group for disseminating informa- 
tion. These rules gave KMF the freedom to create origi- 
nal content while conforming to the most basic level of 
strategic messaging from IS core. Four months later, Al 
Safoo allegedly re-posted a message to the Staff group 


with a reminder to “Adhere to the official media,” which 
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“knows when to publish or avoid publishing; which 


means not every news is good for publishing.””” 


In another telling interaction, KMF members mobilized 
in response to direct instructions from IS central media 
following the mass shooting in Las Vegas on October 1, 
2017. Amaq News Agency released a claim of responsi- 
bility for the attack the next day, despite the absence of 
evidence connecting the perpetrator to IS.“ On October 
2, 2017, the same day of Amaq News Agency’s official 
claim, a KMF member posted in the Staff Group relaying 
a message that the attack was conducted by a “soldier of 
the caliphate,” and another member called to “launch an 
interactive campaign along with the blessed operation.”” 
A day later, KMF released an infographic mentioning the 
attack.” This release occurred in accordance with one of 
the rules set by IS central media for unofficial groups: 
“Commitment to the official [ISIS] announcement stipu- 
lating that it’s not allowed to claim responsibility for any 
operation or attack which hasn’t been announced by the 
State, may Allah glorify it.” 


The clearest indication of a nexus between IS’ central 
media department and KMF concerns a merger be- 
tween KMF and al-Wafa Media Foundation, another 
gray pro-IS media group. KMF leadership in the Writers 
Group discussed a merger with al-Wafa, but ultimate- 
ly abandoned the move “in accordance with the State’s 
instructions.” In messages to the Staff Group, KMF 
leadership asked members to leave the al-Wafa groups, 


noting it was a well-intended mistake to begin a merger. 


This chain of information depicts a hierarchical struc- 
ture with IS core dictating major decisions from the top, 
the Writers Group discussing and debating them, then 
delegating down to the Staff Group.“ 


While further studies are necessary to determine how 
KMF interacted with IS’ central media apparatus, this 
evidence documents that KMF consulted the core media 
operatives on major decisions, including sourcing, im- 
portant media operations, and its relationships to other 
pro-IS media groups. KMF was encouraged to produce 
propaganda independently within a broad set of guide- 
lines and obtained course corrections from IS core when 
necessary. In this manner, KMF provides a compelling 
example of strategic media decentralization embraced 
by IS core as it loses territory. Strategies that intend to 
counter IS media should understand and address the re- 
ality of gray media organizations within the IS propa- 


ganda machine. 


Husnain Rashid and “Lone Mujahid”: 


Operational and Instructional Material 


On November 22, 2017, authorities in the United King- 
dom arrested 31-year-old Husnain Rashid at his home 
in Nelson, Lancashire.” He was charged with terror- 
ism-related offenses, prompted by his threats on Tele- 
gram against the school of Prince George and other tar- 
gets in the UK.* 


promotion. 


articles, and tweets. 


Publishers should adhere to the following: 
1. It’s prohibited to disseminate any article that contains slander or self- 
2. Disseminate whatever benefits the Islamic State: News, releases, 


3. Any individual is allowed to disseminate, and his rights will not be 
violated as long as his postings support the Islamic State. 

4. Commitment to the official [ISIS] announcmeent stipulating that it’s 
not allowed to claim responsibility for any operation or attack which 
hasn’t been announced by the State, may Allah glorify it. 


Figure 22. Rules posted to the KMF Staff Group by co-conspirator #17. 
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By the time of his arrest, Rashid administered channels 
inciting IS-inspired attacks in European cities for at least 
two years under a common brand. His private channels, 


» e 


named “Lone Mujahid,” “LM,” or other derivations, were 
notorious for spreading English-language operational 
instructions to would-be attackers. The Lone Mujahid 
channels included step-by-step instructions for a suc- 
cessful jihadist plot in a Western country, from attack 
methods and means to locations for attack and opera- 
tional security measures. While the threat against Prince 
George likely resulted in Rashid’s arrest and conviction, 
his Telegram channels also contained a multitude of 
other incitements, alongside a deep library of jihadist in- 


structional material. 


This report’s sample contains 25 channels with the 
“Lone Mujahid” brand. The earliest example was creat- 
ed in March 2017 and the latest weeks before Rashid’s 
arrest in October 2017. Like other channel brands ded- 
icated to distributing instructional or operational mate- 
rial, administrators of “Lone Mujahid” forums utilized a 
common method for disseminating information across 
the various channels and encouraging their followers to 


safeguard the material. 


First, Lone Mujahid’s administrators developed several 
ways of inoculating the material they posted from take- 
downs, while ensuring that followers retained constant 
access to the information. Many of the Lone Mujahid 
channels start with a brief warning to subscribers, in the 
information section of the channel or as the first post. 
“This channel will more than likely be deleted by them 
smelly dirty kuffs [kuffar],” the channel advises, “so make 


Figure 23. Husnain Rashid undated photograph. (Source: Reuters) 


sure you save all the posts you (sic) ASAP.”*° Indeed, 
many of the early examples of Lone Mujahid channels 
within the dataset were public channels, making them 
available to a larger range of supporters but also making 
the channel itself vulnerable to takedowns. To sidestep 
regulation, Lone Mujahid’s administrators stored all base 
content for the channels on a backup “master channel.” 
Administrators rarely shared joinlinks to this private 
master channel, ensuring that it would not be deleted or 
reported. When a new Lone Mujahid channel was creat- 
ed, administrators simply shared all the material stored 


on the master channel to the new channel. 


The “master channel” method not only benefited Lone 
Mujahid’s administrators but also followers of the chan- 
nel interested in consistent access to the channel’s repos- 
itory of operational guides. Using the suite of services 
available on Telegram, IS supporters could retain the 
channel’s posts in two separate ways—either by down- 
loading the individual PDFs, documents, videos, and pho- 
tos, or by forwarding the content in the channel to their 
own personal accounts, which automatically backs up the 
posts to Telegram’s cloud feature.*' By utilizing either 
of these features, supporters can access and view infor- 
mation posted in Lone Mujahid channels even after the 


channel was suspended or deleted by administrators. 


Additionally, Lone Mujahid channel administrators 
compiled an extensive amount of supplemental in- 
structional material, including PDF links and video files 
showing how to follow specific instructions within par- 
ticular manuals. Much of the seed content for Lone Mu- 
jahid channels was instructional material contained in 
“The Book of Terror,” a multi-part volume compiled by 
Abu Kitaab al-Ingaltarra which first appeared on the in- 
ternet in 2015.» The book includes chapters detailing the 
religious justifications for jihadist attacks in the West, 
instructions for different types of attacks (explosives, 
knife attacks, truck-rammings, etc.), combat training, 
operational security, and finally, how to make hijrah by 


traveling to IS-held territory. 


Lone Mujahid channels also included other compi- 
lations, including “Resources for the Mujahid: The 


Art of War Collection,” which contained operational 
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instructions alongside histories of the military strate- 
gies used in the early Islamic period and more modern 
treatises on war and insurgency (the table of contents 
includes works by Niccolo Machiavelli, Sun Tzu, Carlos 
Marighella, Mao Zedong, and Che Guevara). Moreover, 
like other channels, it re-appropriated instructional ma- 
terial produced by other jihadist groups, especially by 
re-posting full copies of Inspire’s “Open Source Jihad” 
series. Finally, Lone Mujahid devised its own “opera- 
tional playbooks,” detailing the planning and execution 
of several notorious IS-inspired attackers, including 
Mohamed Lahouaiej-Bouhlel, responsible for a deadly 
2016 truck-ramming attack in Nice, France, and Omar 
Mateen, the 2016 Orlando Pulse Nightclub shooter. It 
released operational playbooks in the “Knights of Lone 
Jihad” series, which encouraged individual supporters to 
carry out attacks in their home countries on behalf of IS 


using the models of previous successful attacks. 


Finally, Lone Mujahid’s administrators reacted to cur- 
rent events, updating information within the channel 
as new attack opportunities or methods arose. During 
the run-up to the 2017 Wimbledon Championships and 
the UEFA Women’s Euro 2017, the channel posted a full 
layout of the Wimbledon championship grounds and 
the arena where the UK national women’s football team 
was scheduled for a match. “I luuurve tennis, don’t you?” 
the post accompanying the Wimbledon arena map read, 
followed by the hashtags #JustTerror, #Wimbledon, and 
lastly, echoing the 2017 Manchester arena bombings, 
#Copycat_ManchesterArena.*° 


Following an attack on Israeli policemen at the Temple 
Mount in Jerusalem in July 2017, Lone Mujahid channels 
began inciting violence against synagogues and kosher 
restaurants in the United Kingdom. “Indeed these apes 
have barred the muslims [sic] from praying salat al Jum’ah 
[Friday prayers] at Masjidul Aqsa [al-Aqsa Mosquel,” one 
post argues, “therefore prevent the Apes from attend- 
ing their places of disbelief.”°° Continued incitements 
and updated operational playbooks on the LM channels 
emerged in the late summer and early fall of 2017, es- 
pecially following the October 2017 mass shooting in 
Las Vegas, for which Amaq News Agency erroneously 


claimed IS responsibility. More importantly, unofficial 


outlets dedicated to operational material cited the shoot- 
ing in playbooks, highlighting the gunman’s process and 


planning as an example for would-be jihadist attackers. 


During the late fall of 2017, Lone Mujahid channels 
distributed propaganda threatening attacks on the up- 
coming 2018 World Cup in Russia, a prominent terror- 
ism researcher in the UK, and British supermarkets. 
In conjunction with a trend in instructional material 
posted on other channels, Lone Mujahid distributed 
instructions related to the production of ricin, cya- 
nide, and other poisons during the fall of 2017. Using 
these poisons, the administrators called for supporters 
to poison produce and other food products in grocery 
stores on behalf of IS. 


The now-infamous post threatening Prince George ap- 
peared on a Lone Mujahid channel for the first time in 
October 2017. “Even the royal family will not be left 
alone, school starts early,” Rashid posted, alongside pic- 
tures released by Kensington Palace of the young prince 
walking to school with his father.” Weeks later, police 
arrested Rashid, and in December 2017, a UK court 
charged him with seven terrorism-related counts, in- 
cluding encouraging terrorism, preparation of terrorist 
attacks, and dissemination of terrorist publications." 
After the legal process, in which prosecutors used ev- 
idence from the Lone Mujahid Telegram channels to 
argue that Rashid created an “e-toolkit for terrorism,” 
Rashid pleaded guilty in May 2018. A court later sen- 


tenced him to a term of 25 years to life in prison. 


While Husnain Rashid was eventually apprehended 
and brought to justice, the Lone Mujahid channels re- 
main instructive in how IS supporters may choose to 
use Telegram to distribute instructional material in the 
future. Evidence from after Rashid’s sentencing poten- 
tially highlights the impact of the “Lone Mujahid” model. 
A BBC Monitoring report from July 2018 tracked a new 
iteration of the Lone Mujahid channel which appeared 
after Rashid’s sentencing, using Rashid’s mugshot as a 
profile picture.*' This raises the possibility that the Lone 
Mujahid channels were either coordinated by a number 
of separate administrators like other unofficial IS media 


brands on Telegram, or that IS supporters were copying 
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Rashid’s methods.” In either case, the model used by 
Rashid to distribute instructional material on Telegram 
may have important ramifications for how supporters in 
the future attempt to disseminate operational guides to 


the benefit of IS-inspired attack planners in the West. 


Ultimately, Telegram provides a conducive environ- 
ment for individual personalities and channel “brands” 


to flourish as pro-IS grassroots actors. Inconsistently 


balancing cybersecurity protections with public accessi- 
bility, IS sympathizers use Telegram’s suite of features 
to communicate with like-minded supporters across the 
world, disseminate IS’ official and unofficial media, and 
provide instructional material for operations. With this 
assessment in mind, it is important to explore the impli- 
cations of IS sympathizers’ continued use of Telegram 
and options for counterterrorism policymakers and prac- 


titioners to combat terrorist exploitation of the platform. 
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MARGINALIZING IS SUPPORTERS ON TELEGRAM 


Addressing the challenges posed by IS supporters’ use of 
digital communications technologies is a critical area of 
responsibility for counterterrorism authorities world- 
wide. In these efforts, it is highly important for policy 
to reflect the landscape of IS supporters’ exploitation of 
the digital toolbox, and formulate strategies that lim- 
it the dexterity and influence of violent extremists on- 
line. While this study examines a small demographic on 
a specific but important platform, the findings from the 
study’s overarching research questions contribute to 
broader assessments about how IS supporters utilize a 


wide range of tools to achieve strategic aims. 


The following considerations for policymakers, prac- 
titioners, and technology companies strive to integrate 
the findings of this report into a strategic architecture 
to confront violent extremists online. After defining the 
current parameters of the problem set, these consider- 
ations are designed to influence policies that marginal- 


ize the impact of IS supporters in the online space. 


Among the study’s demographic, a short- 
term, large-scale shift away from Telegram or 
to another digital communications platform 
is unlikely. 

This report found that English-speaking IS supporters 


tend to prefer Telegram because it offers several invalu- 
able features, including expanded file-sharing services 
and groups of up to 200,000 members. These, among 
other features, are vital for IS sympathizers’ online com- 
munication and distribution of media products. In ad- 
dition, Telegram is relatively user-friendly; creating an 
account only requires a working phone number, and all 
that is needed to access pro-IS content is either a search 
for public groups and channels or a single joinlink. Tele- 
gram also offers basic security, including by restricting 
access to channels and groups to users with valid join- 
links, providing relative anonymity, offering encryption 


features, and guaranteeing that information shared on 


private groups and channels will not be disclosed to 


third parties. 


Yet, if complete operational security was an overriding 
goal, English-speaking IS supporters would have already 
shifted towards other digital communications tools with 
better security affordances. Cryptologists frequently pil- 
lory Telegram’s security, some arguing that “the safest 
way to use Telegram would be not to.”' Across the dura- 
tion of this report’s dataset, members of pro-IS Telegram 
channels and groups would periodically comment that 
Telegram was unsafe, filled with spies, and lacked the 
ability to reach the public. But almost three years after 
this demographic’s exodus from Twitter to Telegram, 
no other platforms appear to have developed the same 
balance of features, user-friendliness, and basic security 


that could warrant a new switch. 


IS media outlets continuously attempt to influence a shift 
away from Telegram towards other platforms. During 
this report’s data collection, outlets like Nashir News 
Agency and Amaq News Agency urged followers to di- 
versify from Telegram, either by exploiting new, upstart 
social media and file-sharing platforms or attempting 
to move towards more technologically sophisticated or 
secure options. As an example of the former, in the sum- 
mer of 2017, IS supporters created several accounts on 
the social media feed aggregator Baaz.’ Baaz is a small 
U.S. company which, despite limited resources, quickly 
responded to the exploitation of its platform.* Although 
Nashir News Agency and Amaq News Agency attempted 
to develop a network of Baaz accounts, the platform has 
not gained traction amongst English-speaking IS sup- 


porters.* 


Concerns persist about IS supporters exploiting other 
online instant messengers, particularly with more ad- 
vanced security protocols. In December 2018, after a 
reported increase in Telegram’s enforcement of ToS, 
Amaq News Agency and Nashir News Agency pro- 


moted Rocket.Chat, another online messenger.* Nashir 
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News Agency exhorted its followers to join Rocket. 
Chat, claiming that it would begin to publish news re- 
leases on Rocket.Chat before Telegram, and distributed 
an instructional guide detailing how to use the service. 
Around December 2018, several researchers of IS online 
activity argued that IS supporters have also made multi- 
ple attempts to build an infrastructure on decentralized 
web platforms like ZeroNet and Riot, which distribute 
access to data across its participants rather than storing 


it in a centralized location.’ 


An unknown number of intervening variables over the 
medium and long-term make predictions nearly impos- 
sible. Yet, as it stands today, there is little evidence to 
suggest that a massive shift of IS supporters from Tele- 
gram to elsewhere, on the scale of the departure from 
public-facing social media in 2015-2017, is currently 
underway. While Telegram has made notable chang- 
es to its ToS enforcement and executed some notable 
takedowns of IS content, its mixed signals and opacity 
weaken its signal to supporters that the service is no lon- 
ger a safe haven for them. Without another application 
that outmatches Telegram’s blend of public outreach, 
file-sharing, user-friendliness, and security features, it 
is reasonable to forecast that in the short-term, many 
English-language IS supporters will remain on the plat- 


form. 


The principle of marginalization should 
undergird efforts to counter IS supporters 
online, including on Telegram. 


Currently, the implicit intent of efforts to counter terror- 
ist exploitation of digital communications technologies 
is to completely eliminate terrorists’ accounts and con- 
tent online through takedowns, namely through account 
suspensions and content removal. This approach heavily 
mirrors offline counterterrorism efforts such as leader- 
ship decapitation and kinetic clearing operations. But in 
this case, the online and offline realms are not analogous. 
Online supporters of terrorist groups are highly dexter- 
ous, moving between platforms and constantly recreat- 
ing accounts while uploading content at a higher pace 
than it can be theoretically taken down.’ Unlike taking 
a leader of a terrorist group off the battlefield through 


an arrest or targeted killing, takedowns do not prevent 


extremist actors from continuing support online.’ 


Nevertheless, the takedown-centric approach to online 
terrorist content is popular in several Western countries, 
with a variety of governments attempting to respond to 
radicalization and terrorist attacks by calling in turn for 
digital service providers to take a harder line on terror- 
ist content. In Germany, the Gesetz zur Verbesserung der 
Rechtsdurchsetzung in sozialen Netzwerken (also referred 
to as NetzDG or the Facebook Law) fines companies 
that fail to take down objectionable content within an 
allotted time period up to €50 million.'° In the United 
Kingdom, policymakers constantly threaten social me- 
dia providers with boycotts, advertising bans, and fines, 
over claims that the companies are “not doing enough” 
to counter the spread of extremist propaganda on their 


platforms." 


This approach is logical when technology companies have 
an incentive and interest in complying with government 
requests or risk economic disincentives when they fail to 
remove terrorist content from their platforms. For these 
reasons, this type of government pressure is especially 
unlikely to work with Telegram. Telegram’s distributed 
data infrastructure allows it to dodge subpoenas, it dis- 
plays little interest in cooperating with governments on 
data requests, and it has no shareholders or advertisers 
for governments to leverage. Even in the case where gov- 
ernment pressure on Telegram is successful, all it would 
accomplish is forcing extremists to find new platforms to 
disseminate media and communicate, replicating what 


some have termed the “whack-a-mole” problem.” 


The marginalization paradigm represents one concep- 
tual alternative to takedown-centric online counterter- 
rorism policy. As argued originally by Audrey Alexander 
and William Braniff, marginalization of online extrem- 
ism would involve “a swathe of empowered actors,” who 
“fhelp] to depreciate the influence of violent extremists 
by progressively undermining, drowning out, and side- 
lining radical perspectives.” Marginalization-driven 
policies differ from the current approach in two ways. 
First, rather than aiming for the untenable goal of tak- 


ing down 100% of terrorist content on any platform, 
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marginalization seeks to contain extremist actors within 
platforms where it is both 1) difficult for extremist ideas 
to reach the public, and 2) possible for law enforcement 
to detect, monitor, and investigate extremist activity on 


the platform. '* 


Applying the marginalization paradigm entails strate- 
gic recommendations for the wide array of actors who 
are currently involved in online counterterrorism and 
helps clarify roles and responsibilities between them. 
The competing objectives of law enforcement, intelli- 
gence, the military, researchers, journalists, and technol- 
ogy companies in the online space impedes coordination 
when actors fail to realize how their own policies could 
potentially conflict with the efforts of others, or acciden- 
tally empower the voices of violent extremists online.!* 
For instance, social media providers have an incentive to 
remove content from their platforms, but their policies 
may cause an unintended migration to another platform 
with fewer resources. As another example, journalists 
and researchers occasionally rebroadcast unofficial IS 
media, but erroneously cite it as signs of an imminent 
threat or a declaration on behalf of the groups’ official 


media apparatus.'° 


A marginalization-based online counterterrorism strat- 
egy proportionally responds to the actual capabilities 
and credibility of violent extremists, rather than imme- 
diately and preemptively responding to a hypothetical 
ability that they could develop. Media and public hype 
about the strength and frequency of extremist content 
online can accidentally amplify extremist propaganda 
and narratives by rebroadcasting them into public dis- 
course.” In contrast, marginalization-focused policies 
aim to cordon off extremists into low-visibility online 
spaces and limit their reach to public-facing mass media, 
while taking the opportunity to monitor their actions 


and behavior. 


Compared to public-facing social media and 
file-sharing platforms, IS supporters are 
marginalized on Telegram. 


English-speaking IS supporters’ reliance on Telegram 


sidelines many of their viewpoints from reaching the 


public. The arguments made by IS official media distrib- 
utors in the early days of Telegram usage—that it was 
effective only for secure communications and internal 
media distribution, but not for da’wa, radicalization or 
recruitment— appear to have borne out.'* While it is still 
relatively easy to access pro-IS content on Telegram, 
even for a new user, the hurdles in place to ensure com- 
munication security also weed out potential recruits. 
More importantly, they nearly eliminate the risk that an 
uninitiated individual would “stumble across” IS’ online 


media.'” 


Governments and service providers should shape their 
responses to IS’ use of Telegram based on the marginal- 
ization paradigm: Do the benefits that extremists gain from 
using Telegram outweigh their losses from not being able to 
exploit other digital communications services? Reliance on 
Telegram stunted English-speaking IS supporters efforts 
to develop a foothold on more secure or more public- 
ly-accessible platforms, and lured supporters into a false 
sense of operational security. These downsides outweigh 
the strategic benefits of Telegram for IS supporters. 
Consequently, efforts by governments and service pro- 
viders should focus on containing, monitoring, surveil- 
ling and investigating English-speaking IS supporters 
on Telegram, rather than pressuring the company to 


de-platform IS supporters. 


In accordance with the first principle of marginaliza- 
tion, Telegram is one step removed from access to main- 
stream media, limiting the public reach of IS munasireen. 
When English-speaking IS supporters were highly active 
on platforms like Twitter and Facebook, the possibility 
that IS narratives or media releases would penetrate 
public discourse and directly interact with the public 
was higher. Supporters’ attempts to repost content from 
Telegram to mainstream, public-facing social media and 
file-sharing platforms are charitably described as an 
uphill battle.” Sympathizers can create repositories of 
content on Telegram, but since joinlinks are necessary 
to access most channels and groups, the number of peo- 
ple who will view the content on Telegram is inherently 
limited. Even public channels are restricted to users al- 
ready on Telegram, with prior knowledge of key words 


to effectively search for IS content. 
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Fulfilling the second principle of the marginalization 
paradigm, IS supporters’ dependence on Telegram ben- 
efits counterterrorism authorities. There are opportuni- 
ties for law enforcement to detect, monitor, and investi- 
gate extremist activity on Telegram, as evidenced by the 
arrests of Karen Hamidon, Ashraf Al Safoo, and Husnain 
Rashid. The “going dark” problem does engender im- 
portant challenges for law enforcement as they attempt 
to investigate the activities of malicious and criminal ac- 
tors, including terrorists.” As a digital communications 
service, Telegram includes a suite of features, some that 
exacerbate the “going dark” problem and some that do 
not. Telegram’s channels and groups, the subject of this 
report, notably lack many of the security options that 


other features on Telegram boast. 


More broadly, the cybersecurity protocols that sym- 
pathizers employ are often rendered ineffective by 
substandard operational security. IS supporters face 
a conundrum in the use of online messaging tools like 
Telegram—employing iron-clad security measures can 
isolate online networks from adding potential new mem- 
bers. IS’ reliance on public outreach for new recruits can 
result in online breaches by the organization’s adver- 
saries. Taking this risk, many pro-IS Telegram admin- 
istrators open their groups and channels, and sometimes 
even direct communications to unknown and unverified 
accounts. This vulnerability is ripe for exploitation by 
law enforcement, allowing an entryway for investigators 
to breach the network, garner evidence of criminal activ- 


ity and in some cases, arrest and prosecute supporters. 


In engagement with Telegram, governments 
should encourage Telegram to participate in 
industry-driven forums for counterterrorism 
collaboration. 


To date, government responses to terrorist exploita- 
tion of Telegram have been largely disincentive-based. 
Threatening to levy fines, bans, or other punishments 
towards platforms who fail to moderate terrorist con- 
tent can theoretically be effective in pressuring com- 
panies into taking tougher stances, provided that the 
company would avoid economic or legal issues by com- 


plying. Telegram, as a multinational, data-distributed, 


shareholder-free entity, would not be affected by many 
of the disincentives that governments attempt to apply 
to social media providers. A potential alternative is for 
governments to encourage Telegram to participate in 
industry-led mechanisms for cooperation between tech- 


nology companies. 


This is not to say that governments should completely 
abandon disincentives in cases of non-compliance by 
Telegram, but that a prerequisite to applying targeted 
disincentives is encouraging Telegram to come to the 
table. Though Telegram may still refuse to directly re- 
spond to government requests for data, governments can 
encourage the service provider to employ best practices 
developed through industry-led, not government-man- 


dated, forums. 


While they are still developing, several forums for tech- 
nology industry collaboration on countering terrorist 
propaganda online emerged during the past few years. 
Chief among them is the Global Internet Forum to 
Counter Terrorism (GIFCT), a forum established in 2017 
by Facebook, Twitter, Google, and Microsoft.” Among 
other initiatives, including collaboration on techno- 
logical solutions, support and engagement with the re- 
search community, and coordination with governments, 
GIFCT aims to “[share] best practices around counter- 
terrorism...in particular focusing on knowledge sharing 
with smaller tech companies.””* In these endeavors, they 
are supported by Tech Against Terrorism, a program 
established by the United Nations Counter-Terrorism 
Executive Directorate (UN-CTED), which holds round- 
tables and trainings for smaller service providers on ad- 


dressing terrorist content on their platforms.” 


To date, Telegram has taken multiple steps to increase 
public transparency, including by making their API 
more accessible and available. The August 2018 up- 
date of Telegram’s privacy policy to include provisions 
for law enforcement cooperation, combined with the 
decision to issue a transparency report, should also be 
commended. A further step that governments could 
encourage is Telegram’s contribution to Tech Against 
Terrorism’s Knowledge Sharing Platform (KSP), which 


would allow Telegram to share its perspectives with its 
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industry partners.” Telegram, as a central node for IS 
propaganda and activity, could provide valuable insight 
to other technology companies by sharing their observa- 


tions of trends. 


Telegram’s participation in the KSP would also be in- 
valuable for smaller file-sharing services and social me- 
dia sites. Telegram could alert these service providers 
when IS supporters are attempting to bandwagon or 
promote the use of their platforms. Moreover, knowl- 
edge-sharing between Telegram and other platforms 
could improve their collective capacity for effective con- 
tent moderation, preventing pro-IS content on Telegram 
from springboarding onto the public-facing web through 


file-sharing or lesser-known social media platforms. 


In turn, Telegram could gain new insight into practic- 
es that can benefit their platform, while contributing to 
other technology companies’ bodies of knowledge on 
terrorist use of digital communications services. Beyond 
ToS enforcement, Telegram can learn about other crit- 
ical methods in online counterterrorism, such as trans- 
parency reporting, anti-spam tools and crowdsourced 
or automatic detection of terrorist content. Even absent 
participation in industry-led forums, Telegram may 
consider investments in research about terrorist use of 
Telegram, or bringing in independent reviewers to mon- 
itor and assess trends. Ultimately, government encour- 
agement of these developments builds the capacity of 
technology providers to proportionally respond to ter- 


rorist use of the internet. 


Heavy-handed approaches—such as 
weakening or limiting encryption, or banning 
Telegram—are disproportionate, ineffective 
and create negative side effects. 


Successful terrorist attacks, facilitated using services that 
offer encrypted messaging, spark responses by numerous 
governments to weaken or limit encryption protocols, or 
even ban particular services. Authorities in the United 
States, United Kingdom, Germany, and other Western 
democracies have previously called for the installation 
of backdoors into popular messaging services or weak- 


ening the strength of encryption.” Meanwhile, other 


governments have attempted outright bans on the use of 
particular messaging services that offer encryption. This 
study’s findings demonstrate that adopting either re- 
sponse would not constitute an effective solution to the 
use of digital communications technologies by IS sym- 
pathizers. These approaches represent disproportionate 
responses to the use of encrypted communications by 
terrorist groups. Encryption technology is used daily by 
hundreds of millions of people for legitimate and neces- 
sary purposes.” It is irresponsible to existentially target 
encryption due to its use by a small group of malign us- 


ers. 


In an August 2017 article, Aaron Brantly argues that 
weakening encryption or installing backdoors in messag- 
ing applications would entail little to no national security 
benefit for Western governments.” Should the govern- 
ment ban or weaken encryption, the code to produce an 
encrypted messaging platform is already open-source, 
and malicious actors could simply create their own plat- 
form free from government monitoring.” The pressure 
to install backdoors creates a perception of distrust of 
law enforcement amongst service providers, inhibit- 
ing cooperation between government and technology 
companies.” Brantly argues that weakening encryption 
could force terrorists onto platforms that complicate 
surveillance efforts, and that the prudent alternative is 
to increase the capacity for law enforcement to monitor 
terrorists on existing platforms.*! While targeting en- 
cryption is an “easy punching bag,” the professed cure is 
worse than the disease: “undermining the digital security 
of society without improving the capability of security 
services in a sustained way to detect terrorist activity is a 


worse than futile exercise.”* 


Complete bans against Telegram are even more disas- 
trous. To date, the governments that banned Telegram 
are largely authoritarian: two notable examples are 
Russia and Iran.” In 2018, Iran’s judiciary and Russia’s 
chief communications authority both declared the ser- 
vice a threat to national security and banned it on the 
grounds that it was used to facilitate terrorist attacks.“ 
Both bans were unmitigated disasters. In Iran, some 
estimates claimed that over half the population used 


Telegram daily, and that half of Iran’s daily internet 
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bandwidth came from individuals accessing the service. 
The ban struck major blows to Iran’s economy, and ul- 
timately led to circumvention as users installed VPNs 
and other services to side-step the ban and access Tele- 
gram.” In Russia, collateral damage from the Telegram 
ban nearly shut down the Russian internet, after the 
Russian communications authority mistakenly blocked 
over 15 million IP addresses on Google and Amazon 


web-hosting services.” 


So far, calls for platform bans in Western democracies 


appear to represent political bluster rather than actual 


commitment to carrying out a policy. Yet, even the sug- 
gestion of targeting encryption has the potential to cre- 
ate a chilling effect that could threaten an already fragile 
relationship between the government and digital com- 
munications service providers. Heeding examples from 
around the world, the economic, social, and political 
costs of threatening bans or forced backdoors against 
messaging platforms far outweigh the debatable nation- 
al security benefits. Western governments, including the 
U.S. government, should consider the potential negative 


effects of such statements and policies before action. 
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The Islamic State’s global band of online munasireen are 
at a unique but unstable precipice. The organization’s 
self-proclaimed Caliphate in Syria and Iraq—complete 
with physical territory, proto-governance capabilities, 
and an extensive media architecture—is currently in dis- 
array. Across the world, English-speaking IS supporters 
responded to these tribulations, fighting to stay active on 
platforms on which they could reach the masses while at- 


tempting to fill gaps in officially produced IS propaganda. 


This report found that for English-speaking IS munasireen, 
Telegram’s suite of features provided ample opportuni- 
ties to create a host of innovative, multimedia content 
and distribute it amongst like-minded 
sympathizers. A distinctive ecosystem 
of accounts, channels, and groups 
became the first link connecting IS’ 
central media outlets to worldwide 
grassroots actors. Using a madden- 
ing range of file-sharing services and 
lesser-known social media platforms, 
supporters waged an active insur- 
gency against major platforms’ ToS 
enforcement. Moreover, individuals 
and unofficial entities generated their 
own media and developed unique 
personalities. At times, they strategi- 
cally coordinated content production, 
following guidance from the official IS structure. Others 
deviated from this path and concocted homemade con- 
tent to complement official releases, adding to the repos- 


itory of propaganda for English-speaking IS supporters. 


These efforts, combined with the use of Telegram’s secret 
chat function by IS-affiliated attack planners and perpe- 
trators, wrought intense focus by scholars, analysts, and 
journalists. As policymakers and technology companies 
prepare for the next stage of the fight against IS online, 
sober assessments of how IS supporters currently use 
digital communications technologies are of the utmost 
importance. With regard to Telegram specifically, it is 


now an understood fact that the platform is preferred by 


Telegram’s suite of 
features provided 
ample opportunities 

to create a host of 
innovative, multimedia 
content and distribute 
it amongst like-minded 


IS sympathizers. 


IS sympathizers and that pro-IS content is readily avail- 
able. However, findings from this report help to dispel 
some popular misconceptions about how and why En- 


glish-speaking IS supporters utilize Telegram. 


First, while the common assessment is that IS munasireen 
strategically moved to Telegram from mainstream so- 
cial media sites for impenetrable cybersecurity, further 
analysis shows that this move balanced a desire for in- 
creased cybersecurity with the necessity for public ac- 
cessibility. Telegram is an online messenger that offers 
end-to-end encryption in some features. It is not, as 
commonly claimed, an end-to-end encrypted messaging 
platform. Nevertheless, IS sympa- 
thizers still use Telegram’s channels 
and groups, sometimes with the mis- 
conception that it will conceal illegal 
activity. Telegram’s refusals to pro- 
vide information on individual users 
to law enforcement and reticence on 
ToS enforcement are highly attractive 
to English-speaking IS supporters. 
Even under Telegram’s newly-ad- 
opted guidelines, private channels 
and groups, constituting 70% of this 
report’s sample, are still exempt from 
Thus, 


Telegram’s security (or lack thereof), 


enforcement. regardless of 
IS munasireen will likely continue using the service be- 
cause it is a relatively safe online haven for propaganda 


and messaging. 


Second, despite some barriers to gathering information 
about the individuals behind accounts, law enforce- 
ment agencies in several countries have built successful 
prosecutions of [S-affiliated individuals and networks 
using data from Telegram. Turning sympathizers’ lack 
of effective operational security against them, law en- 
forcement can use tried and tested tactics to gain access 
to Telegram groups and channels, build relationships 
with sympathizers using undercover accounts or co- 


operating sources, and demolish trust within online 
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networks. Munasireen are forced into a corner due to 
the success of law enforcement investigations on Tele- 
gram. Without resources or wherewithal, they either 
continue connecting with unverified accounts to build 
networks or reject all new entrants, denying them the 


ability to garner support. 


Overall, much like IS’ precarious position in the physi- 
cal space, its online supporters face a rapidly changing 
environment that forces the demographic to be quick 
thinkers, making agile, strategic decisions as they are 
allowed or denied access to new services. Governments 
and technology companies are arguably in the consis- 
tent, unenviable position of being one step behind de- 
velopments in terrorist exploitation of digital commu- 
nications technologies. Telegram, and the governments 
which engage with it, should draw key lessons from how 


IS sympathizers are using the platform in formulating 


policy responses. They should also draw from the last 
major exodus of IS munasireen when public-facing social 
media sites employed the aggressive ToS enforcement 


that forced IS supporters onto services like Telegram. 


Today, Telegram appears to be increasing its ToS en- 
forcement and potentially changing its tune on cooper- 
ation with law enforcement. It remains unclear wheth- 
er these developments may cause IS supporters to turn 
to other online platforms, but it is important to con- 
sider that this demographic consistently demonstrates 
agility in the adoption of new, underexplored plat- 
forms during times of pressure. Thus, while attempts 
to de-platform IS supporters from Telegram may neu- 
tralize IS networks on the service, this may come at 
the expense of the broader fight against IS online, as IS 
munasireen delve deeper into obscure or opaque digital 


communications platforms. 
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